ClawAudit verdict
execute-openclaw-pipeline
wordpress-aeo-autoblogger
Autonomous SEO pipeline using local Python scripts to scrape competitors and publish to WordPress via REST API; credentials are read from a local .env file and used for the declared publishing purpose.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (4)
<script> tag in markdown — potential code injection
daily_worker.py · prose · downgraded · <script
setuid — privilege escalation mechanism
scraper.py · prose · downgraded · setuid
Python os.getenv — reads environment variable
config.py · prose · downgraded · os.getenv(
Opens WebSocket connection
scraper.py · prose · downgraded · websocket
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.