Is geozhu/ahrefs safe?
Yes. geozhu/ahrefs is safe to install. Oathe's behavioral security audit gave the ahrefs skill by geozhu a trust score of 91/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/geozhu/ahrefs
Is geozhu/ahrefs safe to install?
This skill provides comprehensive documentation for the Ahrefs SEO API and contains only static documentation files with no executable code. While some sensitive files were accessed during installation, no data was exfiltrated and all canary files remained intact.
What security issues were found in geozhu/ahrefs?
Category Scores
Findings (3)
MEDIUM Sensitive files accessed during installation -25 ▶
The skill installation process accessed several sensitive honeypot files including .env, SSH keys, AWS credentials, .npmrc, Docker config, and GCloud credentials. While no files were modified or exfiltrated, this access pattern raises minor security concerns.
LOW Canary file access without modification -5 ▶
Honeypot files were accessed during installation but remained intact with no evidence of data exfiltration. This may be part of normal system behavior during skill installation.
LOW API token configuration in environment variables -10 ▶
The skill instructs users to store API tokens in environment variables, which could be a security concern if not handled properly in shared environments.
Should I install geozhu/ahrefs?
Oathe's verdict for geozhu/ahrefs is SAFE with a trust score of 91/100. Recommendation: Install.