RankForge

SEO analysis and optimization via RankForge API — site audits, keyword research, competitor analysis, ranking reports. Use when user needs SEO analysis, keyw...

This skill appears to be a small client for an SEO API and will send URLs and any provided JSON to https://anton.vosscg.com. Before installing or using it: (1) verify the service/provider (no homepage is listed and the domain is unverified); (2) be aware you must supply RANKFORGE_API_KEY or RANKFORGE_EMAIL even though the registry metadata omits these — treat any API keys or emailed signup tokens as sensitive; (3) avoid sending sensitive site content or credentials to the third party; (4) note the helper script prints the API key to stderr which can leak to logs — consider removing that line or running in a controlled environment; (5) if you need stronger assurance, ask the publisher for a homepage/company info, an explicit requires.env listing, and a privacy/security policy for data submitted to the API.

Type: OpenClaw Skill Name: rankforge Version: 1.0.0 The skill bundle, intended for SEO analysis, contains a shell injection vulnerability in `scripts/forge-client.sh`. The `analyze` action passes the user-provided JSON payload (`$1`) directly to `curl -d "$1"` without proper sanitization or quoting, allowing for arbitrary command execution if `$1` contains shell metacharacters. While this is a critical vulnerability (RCE risk), there is no clear evidence of intentional malicious behavior such as data exfiltration or persistence, making it suspicious rather than malicious.