seo-audit@r2

VERIFIED· install only

Publisher claims: "When the user wants to audit or diagnose SEO, or asks why traffic dropped, a page won't rank, or whether a setup like canonicals, hreflang, or redirects is right: technical SEO, indexing, Google updates, on-page and titles, Core Web Vitals, local SEO. Start here when someone just says their SEO is bad. For pages at scale, see programmatic-seo. For structured data, see schema. For AI search, see ai-seo." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher coreyhaines31 · publishing for 104 daysInstalls 251KLast detonated 21 h ago

$npx skills add seo-audit

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

Is seo-audit@r2 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 91/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

MEDIUM

File type combined with upload actionevals/evals.json:7 · File type combined with upload action — agent may exfiltrate local data files

…s, On-Page Optimization, Content Quality, Authority & Links. Should check robots.txt, XML sitemap, site architecture. Should evaluate title tags, meta descriptions, heading structure, and content optimization. Should NOT report on schema m…

Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

No other findings across 1,457 lines in 9 files.

Cost to the agent

Instructions loaded

≈4,439 tok

1 file · 9 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.