rankup

SUSPICIOUS: the skill's footprint broadly matches its growth/website-orchestration purpose, so it is not fundamentally deceptive. However, it carries elevated risk from transitive skill installation, GitHub-archive OpenCLI install paths, heavy use of logged-in browser sessions, and permission to perform real external actions across many services.

当前片段主要是项目运维与 SEO 流程文档，没有直接证据表明包含恶意软件、数据窃取或后门。存在明显的凭据管理风险：不应将 Cloudflare Global API Key 写入 ~/.zshenv 或通过命令行环境长期保存，应改用最小权限、限定 zone 和操作范围的 Token，并使用受控 secret store。所有 DNS、部署、邮件路由、支付和 OAuth 操作都应在授权确认及目标核对后执行。

The code appears to implement legitimate Yandex Webmaster and Cloudflare DNS automation, with no clear malicious behavior or intentional data exfiltration. However, cli() and open() construct shell commands with unescaped user-controlled values, creating a plausible command-injection risk through --session or a crafted --site URL. Cloudflare credentials are also handled from environment variables or a local token file and should be protected with strict file permissions. The module should be reviewed and fixed before accepting untrusted command-line arguments.

The code appears to be a legitimate webmaster sitemap automation and evidence-capture script. It does not show clear malware, credential theft, suspicious network exfiltration, or destructive behavior. It has a significant command-injection risk because user-controlled --session and URL-derived values are interpolated into execSync shell commands without safe argument handling. Use spawnSync/execFile with argument arrays or strict escaping and validation. The fragment alone provides insufficient evidence of malicious intent.

No clear evidence of malware payloads (exfiltration, backdoors, or destructive behavior) appears in the visible fragment. The primary security concern is the high-privilege browser-context execution primitive: dynamically constructed JavaScript is executed via opencli’s browser 'eval' while operating with authenticated requests (credentials:'include') and token/header scraping. This makes the module sensitive to injection/sabotage and warrants careful review of how expr is constructed and controlled, plus verification of opencli’s eval semantics. Confidence is limited by a truncated/garbled section in the Similarweb portion.

The fragment is a readable Ahrefs setup automation CLI, not apparent malware. It performs expected browser automation for project creation, ownership verification, and Web Analytics enablement. However, it has a material command-injection risk because untrusted CLI values are interpolated into shell commands executed by execSync(), and a secondary code-injection risk from embedding site in evaluated JavaScript. Inputs should be validated and passed using a non-shell argument API or robust escaping; dynamic browser JavaScript should use JSON.stringify for values. The supplied fragment contains no clear data theft, backdoor, destructive behavior, or suspicious external endpoint.

The code appears to implement a legitimate domain-reporting CLI and contains no clear embedded malware, credential theft, persistence, or destructive behavior. However, it has a high-impact command-injection vulnerability in the 404 fallback and a path-traversal risk in report storage because the domain is not validated or safely passed to the shell/filesystem. The runtime `npx` execution also creates a supply-chain exposure. Domain input should be strictly hostname-validated, filesystem components should be safely encoded or constrained, and the CLI should use spawn/execFile with an argument array and a pinned dependency.

This module is a DOM automation helper that also implements a strong clipboard/text harvesting capability: during a capture window it installs a document 'copy' listener to read clipboard contents and monkey-patches navigator.clipboard.writeText to record text written to the clipboard, then exposes the captured content through a globally accessible window.__rk API. Even without visible network exfiltration in this snippet, the harvested data is readily retrievable by any co-resident script, creating a significant supply-chain security risk.

No explicit malware behavior (e.g., persistence, destructive actions, hardcoded credentials, or obvious malicious network exfiltration) is present in this module. However, it is security-sensitive: it executes dynamic JavaScript inside a real browser via an external tool and performs authenticated fetches using credentials:"include" to URLs derived from caller-controlled path inputs. The overall risk depends on upstream input validation, strict URL/origin allowlisting in abs()/callers, and the safety/constraint model of the external `opencli` tool.

The code appears to be a legitimate browser-based analytics beacon inspection tool, with no clear malware or data-theft behavior. However, it has a meaningful command-injection risk because user-controlled URL and session values are interpolated into shell commands executed by execSync(). Timing arguments are also insufficiently validated before being embedded in generated JavaScript. Use an argument-array subprocess API, strict URL parsing, and numeric validation before use. Confidence is high for the identified risks and low for malicious intent.

High-risk client-side clipboard interception and API tampering. The module temporarily hooks the document 'copy' event and overrides navigator.clipboard.writeText to capture plaintext being copied, then returns that captured content after triggering a “复制本段” copy action. While no direct network exfiltration is shown in this fragment, the capability is privacy-invasive and commonly used for data harvesting/clipboard theft when paired with other code.

This module is primarily an analytics/enrichment CLI, but it contains a high-risk pattern: browser automation via `opencli ... eval` where an expression is dynamically constructed (MINE_EXPR) and executed in an authenticated browser context. Additionally, it scrapes auth tokens/headers from authenticated HTML to authorize subsequent API calls. While there is no clear evidence of third-party exfiltration or destructive system actions in the snippet, the eval-in-privileged-context behavior makes supply-chain sabotage or abuse plausible and should be reviewed carefully (especially domain input validation and opencli eval isolation).

No clear malware/backdoor behavior is present in this module; it implements a straightforward IndexNow submission workflow (URL collection, optional ownership key validation, and HTTP POST). The security concern is primarily misuse potential: unvalidated, user-controlled --endpoint and other network target flags allow the script to POST sensitive data (key/keyLocation and full urlList) to arbitrary servers and to make outbound requests to attacker-chosen URLs. In trusted CI/developer usage with intended defaults, risk is lower; if invocation arguments can be influenced by an attacker, risk increases significantly.