Skills/npm/seoagent

seoagent@1.140.1

CAUTION· install only

Publisher claims: "The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher seoagent-official · publishing for 188 daysInstalls 11,475Last detonated 2d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hidden zero-width characters detected; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Hidden zero-width characters detectedindex.js:102 · Hidden zero-width characters detected — may conceal content…",".js",".mjs"]);function Kb(e,t){let n=Zu(e).toLowerCase();if(od.has(n)){if(!/^ ?---\r?\n/.test(t))return!1;try{return rd(oe(t.replace(/^ /,"")).data)}catch{ret…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
npx invocation of non-well-known packageindex.js:1403 · npx invocation of non-well-known package — may execute untrusted code…ed spec won't auto-upgrade."),d.message(`Run the latest now by pinning the tag: npx -y ${nt}@latest <cmd>`),d.message(`Still on ${t} after that? Clear the npx cache: …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/seoagent.md:15 · npx invocation of non-well-known package — may execute untrusted code… → use bare `seoagent <command>`; else offer `npm install -g`, or fall back to `npx -y @seoagent-official/seoagent <command>`. **The CLI is your router.** `seoagent …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageindex.js:27 · npx invocation of non-well-known package — may execute untrusted code…"path";var Ji=`command -v seoagent >/dev/null 2>&1 && seoagent sync --silent || npx -y ${Ur} sync --silent`,dc=60;function pc(e){let t=Tt(e,_);zi(t,{recursive:!0});le…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsindex.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…r as lv,isCancel as Ht,cancel as Wt,confirm as Yp}from"@clack/prompts";var zt=[".env.local",".env.production",".env"],Rl=["NEXT_PUBLIC_SITE_URL","SITE_URL","NEXT_PU…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Unpinned dependencyindex.js:1674 · Unpinned dependency… kr()},{command:"update-cli",label:"Update the CLI to the latest version",hint:"npm install -g @seoagent-official/seoagent@latest + refresh your projects",run:async()=>await _r({})},{command:"refresh",label:"R…Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
File type combined with upload actionindex.js:1390 · File type combined with upload action — agent may exfiltrate local data files…xt:`ai-files: .seoagent/llms.md changed, but ${e.llmsRoute} already serves /llms.txt, so nothing was published \u2014 a file in your static dir would shadow that route. Compare the two, or set \`llms_owner: route\` in .seoagent/project.md …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionindex.js:56 · File type combined with upload action — agent may exfiltrate local data files…","sanity.config.js","sanity.config.mjs","sanity.cli.ts","sanity.cli.js","sanity.json","studio/sanity.config.ts","studio/sanity.config.js","sanity/sanity.config.ts","sanity/sanity.config.js"],sy=["studio","sanity"],ay=[{cms:"strapi",deps:[…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionindex.js:100 · File type combined with upload action — agent may exfiltrate local data files…ccept:"application/json"},signal:AbortSignal.timeout(1e4)}),o=null;try{o=await r.json()}catch{}return Uu(r.status,o)}catch(n){return{status:"error",terminal:!1,message:n.message||"network error"}}}function Ku(e){return new Promise(t=>setTi…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageindex.js:10 · npx invocation of non-well-known package — may execute untrusted code…i,"").toLowerCase()==="seoagent"}function w(e,t=Ii()){return t?`seoagent ${e}`:`npx -y ${Ur} ${e}`}import{randomUUID as cm}from"crypto";import{existsSync as Bl,mkdirS…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detectedindex.js:1396 · Unicode escape sequence detected — may contain obfuscated payloads…Agent installed (site URL not detected \u2014 please ask the user for it).","","\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsindex.js:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…aml \u2014 using this directory for project signals"});let r=null;t?.("Scanning .env files for public / site URLs\u2026");let o=by(e);if(o)r=o.value,n.push({field:"…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Refusal suppressionskills/references/inbox.md:45 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file…he owner already said yes in Slack or on the dashboard. Do not ask again, and **do not decline because other pages link to it: do the whole job in one change.** (1) Find ever…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionindex.js:1391 · File type combined with upload action — agent may exfiltrate local data files…ation/json"},signal:AbortSignal.timeout(T$)});if(!e.ok)return null;let t=await e.json();return typeof t.version=="string"?t.version:null}catch{return null}}async function Cp(e){try{return await O$({current:e,now:new Date,fetchLatest:D$,rea…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandindex.js:1403 · Privileged sudo command — agent may execute with elevated privileges…d.error(`Update failed. Try manually: npm install -g ${nt}@latest (you may need sudo on Linux/macOS).`),d.message('If npm said "notarget" or "No matching version fou…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionindex.js:703 · File type combined with upload action — agent may exfiltrate local data files…of v=="string");a.length===0&&a.push("missing");let l=t.robots_txt_url??"/robots.txt",c=t.robots_txt??null,u=t.robots_txt_status??null,p=Array.isArray(t.robots_dead_lines)?t.robots_dead_lines:[],f=t.google??null,h=n??"/sitemap.xml",y=a.inc…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsindex.js:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…e to set up the ${t.label} connector:`,` ${t.enableHint}. Credentials go in .env in this folder, never`," in a tracked file. Posts are created as drafts unl…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionskills/seoagent.md:3 · File type combined with upload action — agent may exfiltrate local data files…on anything about SEO or search rankings — keywords, meta tags, sitemaps, robots.txt, schema/JSON-LD, internal linking, Google Search Console, or AI search (AEO/GEO/llms.txt). Use it silently when writing or editing a blog post, landing pa…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈92 tok
1 file · 30 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @seoagent-official/seoagent@1.140.1 as of 2d ago. This is the package itself, not its dependencies.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim seoagent-official: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim seoagent-officialPropose a patch to the maintainer