On Page Seo Auditor

Security checks across malware telemetry and agentic risk

Overview

This instruction-only SEO auditor is coherent and generally safe, but users should notice that it can fetch webpages, optionally use connected SEO/Search Console data, and write reusable audit summaries to memory.

This appears reasonable to install for on-page SEO audits. Before using it, confirm bulk URL scope, avoid sharing pages or account data you do not want analyzed, be careful when connected Search Console or SEO-tool accounts are available, and review any memory/audit summaries before keeping them for future use.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

The agent may retrieve one or more webpages during an audit, especially for competitor or bulk comparisons.

Why it was flagged

The skill is allowed to fetch web pages, which is central to auditing SEO for supplied URLs but still means the agent will access external web content.

Skill content
allowed-tools: WebFetch
Recommendation

Provide only URLs you are comfortable having the agent fetch, and confirm the page list or sampling approach before large audits.

#
ASI03: Identity and Privilege Abuse
Low
What this means

If such integrations are connected, the audit could use private site analytics or search performance information.

Why it was flagged

The skill may use connected SEO or Search Console integrations if present; this is relevant to SEO auditing, but those services can contain account- or site-specific performance data.

Skill content
Use ~~web crawler, ~~SEO tool, and ~~search console when connected; otherwise ask for page URL/HTML, target keywords, and competitor URLs.
Recommendation

Use least-privilege connections and make sure the agent is using only the intended site property or SEO tool account.

#
ASI06: Memory and Context Poisoning
Low
What this means

SEO findings, priorities, and possibly competitor or business context may be retained for later tasks.

Why it was flagged

The skill creates persistent audit summaries and open-loop items, which can be useful but may influence future agent work or retain business/site details.

Skill content
Writes: a user-facing audit or optimization plan plus a reusable summary that can be stored under `memory/audits/`. Promotes: blocking defects, repeated weaknesses, fix priorities, and pending decisions to `memory/open-loops.md`.
Recommendation

Review memory entries before saving them and avoid storing sensitive business details that are not needed for future SEO work.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

If the agent relies on remote referenced documents, behavior may depend on content outside the packaged skill review.

Why it was flagged

Some workflow and policy references point to external GitHub documents that were not included in the reviewed artifact set, so those referenced instructions were not verified here.

Skill content
finish with the standard handoff summary from [Skill Contract](https://github.com/aaron-he-zhu/seo-geo-claude-skills/blob/main/references/skill-contract.md)
Recommendation

Prefer bundled or pinned reference documents for repeatable behavior, and review any external linked instructions before relying on them.