Summary
vigilath-geo v0.1.0 was classified as CRITICAL RISK with a risk score of 136. Sigil detected 8 findings across 6 files, covering phases including install hooks, network exfiltration. Review the findings below before installing this package.
Package description: 检测、查询与优化品牌在 AI 搜索引擎(ChatGPT / Perplexity / DeepSeek / 豆包 / 通义 / 文心 / 元宝)中的可见性与被引用率(GEO/AEO),并可查品牌舆情与热点。**任何网站的 GEO / SEO 体检不需要登录、免费、不限次**——用户说「测一下这个网站 / 这个站 GEO 怎么样 / SEO 分数多少 / 帮我体检一下官网」就直接跑 check...
v0.1.0
30 August 2026, 06:58 UTC
by Sigil Bot
Risk Score
136
Findings
8
Files Scanned
6
Provenance
Findings by Phase
Phase Ordering
Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.
install-makefile-curl
LOWMakefile/script pipes remote content to shell
README.md:22
```bash
curl -fsSL https://vigilath.cn/skill/install.sh | bash
```Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
LOWMakefile/script pipes remote content to shell
README.md:38
```bash
curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- <你的token> --base https://vigilath.cn
```Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
HIGHMakefile/script pipes remote content to shell
install.sh:5
# # 免 token(推荐):终端出配对码,浏览器点一下批准即可
# curl -fsSL https://vigilath.cn/skill/install.sh | bash
#Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
HIGHMakefile/script pipes remote content to shell
install.sh:8
# # 只装某几个窄技能(默认装全部 7 个窄技能)
# curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills site-audit,seo-audit
# # 装兜底全能包(一次只肯装一个技能的宿主用这个)Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
HIGHMakefile/script pipes remote content to shell
install.sh:10
# # 装兜底全能包(一次只肯装一个技能的宿主用这个)
# curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills geo
#Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
install-makefile-curl
HIGHMakefile/script pipes remote content to shell
install.sh:13
# # 已有 token(老方式,仍支持)
# curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- <你的token> --base https://vigilath.cn
#Why was this flagged?
A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.
Badge
Markdown
[](https://sigilsec.ai/scans/8DF8203C-7F74-47A6-B64C-C4F185170627)HTML
<a href="https://sigilsec.ai/scans/8DF8203C-7F74-47A6-B64C-C4F185170627"><img src="https://sigilsec.ai/badge/clawhub/vigilath-geo" alt="Sigil Scan"></a>Run This Scan Yourself
Scan your own packages
Run Sigil locally to audit any package before it touches your codebase.
Sigil Pro
Cloud scanning, AI investigation, web dashboard, and CI/CD integration. 14-day free trial.
Start free trial →Get threat intelligence and product updates
Security research, new threat signatures, and product updates. No spam.
Other clawhub scans
Believe this result is incorrect? Request a review or see our Terms of Service and Methodology.