ClawHub
Back to skill

Security audit

keyword-scout

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent SEO keyword-research helper that uses disclosed read-only imports and optional configured SEO providers, with no hidden install or persistence behavior found.

Before installing, confirm you are comfortable sharing SEO queries and site data with any configured third-party SEO providers. Because two referenced guidance files are missing, be especially careful with paid DataForSEO runs and require an explicit cost approval before each batch.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
- **Tier 1.** Google Suggest for expansion (unofficial endpoint; treat as hints, `confidence: low`). A SERP the user pastes or fetches is an observation for that query, locale, device, and date — record all four.
- **DataForSEO.** Paid, per-request. Read `dataforseo.md`; show the cost preflight and get approval for each batch.
- **Ahrefs MCP** (`https://api.ahrefs.com/mcp/mcp`, API key on a plan that includes MCP) and **Semrush MCP** (`https://mcp.semrush.com/v1/mcp`, OAuth or API key). Use only when the user already pays for the tool and has configured the MCP in their client. Label rows `source: "ahrefs"` / `"semrush"`, `confidence` per the vendor's own accuracy notes; these are third-party estimates, not the user's own data.
- **TrustGrowth.** `keywords` (typed opportunities with volume, difficulty, intent, current position, scores) for the verified site. SERP snapshots per keyword are scheduled (TEC-7796).

### `~~link database` — backlinks and authority
Confidence
15% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.