SEO Audit Bot

Perform a comprehensive SEO audit of any website. Analyzes technical SEO, on-page factors, content quality, performance, and generates an actionable report w...

This skill appears to do what it says: fetch a URL and analyze HTML for SEO signals. Before installing or running it, note: (1) the README/script expect HTTP fetch capabilities (web_fetch or curl) and typical Unix text tools (curl, grep, sed, wc) even though the registry metadata doesn't list them — ensure your runtime provides them; (2) the skill will fetch any user-supplied URL, so in environments that can reach internal network services this can be used to access intranet endpoints (SSRF risk) — restrict allowed domains or run in an isolated environment if that matters; (3) review the included scripts (scripts/audit.sh) before execution — they write temporary files to /tmp and use standard command-line parsing (no obfuscation), which appears benign. If you need stronger guarantees, run the skill in a sandboxed agent or review/modify the script to enforce allowed hostnames.

Type: OpenClaw Skill Name: seo-audit-bot Version: 1.0.0 The skill provides SEO auditing functionality but includes a shell script (scripts/audit.sh) that is vulnerable to argument injection. The script passes the user-provided URL directly to curl without sanitization, which could allow an attacker to inject additional flags (e.g., -o) to overwrite local files or perform unauthorized network requests. While the skill's instructions in SKILL.md and documentation in README.md align with its stated purpose, the inclusion of a script with a high-risk RCE/file-overwrite vulnerability warrants a suspicious classification.