Skip to main content
Scans/clawhub/vigilath-geo

vigilath-geo

clawhub

Share

Summary

vigilath-geo v0.1.0 was classified as CRITICAL RISK with a risk score of 136. Sigil detected 8 findings across 6 files, covering phases including install hooks, network exfiltration. Review the findings below before installing this package.

Package description: 检测、查询与优化品牌在 AI 搜索引擎(ChatGPT / Perplexity / DeepSeek / 豆包 / 通义 / 文心 / 元宝)中的可见性与被引用率(GEO/AEO),并可查品牌舆情与热点。**任何网站的 GEO / SEO 体检不需要登录、免费、不限次**——用户说「测一下这个网站 / 这个站 GEO 怎么样 / SEO 分数多少 / 帮我体检一下官网」就直接跑 check...

CRITICAL RISK(136)

v0.1.0

30 August 2026, 06:58 UTC

by Sigil Bot

Risk Score

136

Findings

8

Files Scanned

6

Provenance

Findings by Phase

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

LOW

Makefile/script pipes remote content to shell

README.md:22

```bash
curl -fsSL https://vigilath.cn/skill/install.sh | bash
```
Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

install-makefile-curl

LOW

Makefile/script pipes remote content to shell

README.md:38

```bash
curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- <你的token> --base https://vigilath.cn
```
Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

install.sh:5

#   # 免 token(推荐):终端出配对码,浏览器点一下批准即可
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash
#
Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

install.sh:8

#   # 只装某几个窄技能(默认装全部 7 个窄技能)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills site-audit,seo-audit
#   # 装兜底全能包(一次只肯装一个技能的宿主用这个)
Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

install.sh:10

#   # 装兜底全能包(一次只肯装一个技能的宿主用这个)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- --skills geo
#
Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

install.sh:13

#   # 已有 token(老方式,仍支持)
#   curl -fsSL https://vigilath.cn/skill/install.sh | bash -s -- <你的token> --base https://vigilath.cn
#
Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

Badge

Sigil scan badge for clawhub/vigilath-geo

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/vigilath-geo)](https://sigilsec.ai/scans/8DF8203C-7F74-47A6-B64C-C4F185170627)

HTML

<a href="https://sigilsec.ai/scans/8DF8203C-7F74-47A6-B64C-C4F185170627"><img src="https://sigilsec.ai/badge/clawhub/vigilath-geo" alt="Sigil Scan"></a>

Run This Scan Yourself

Scan your own packages

Run Sigil locally to audit any package before it touches your codebase.

curl -sSL https://sigilsec.ai/install.sh | sh
Read the docs →Free. Apache 2.0.

Sigil Pro

Cloud scanning, AI investigation, web dashboard, and CI/CD integration. 14-day free trial.

Start free trial →

Get threat intelligence and product updates

Security research, new threat signatures, and product updates. No spam.

Other clawhub scans

Believe this result is incorrect? Request a review or see our Terms of Service and Methodology.

Scanned bySigil Bot