Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed SEO prompt-library integration; its optional sync command has supply-chain risk but is user-invoked, previewed, and purpose-aligned.
Install is reasonable for users who want the FLOW SEO prompt workflow. Before using `/seo flow sync`, review the dry-run output, confirm the destination is limited to the skill prompt library, and remember that updated prompt text comes from a third-party repository.
The documented /seo flow sync command expands the skill from prompt surfacing into fetching content from a third-party GitHub repository and writing it locally. That creates a supply-chain and local state modification risk: upstream content could change unexpectedly, be maliciously replaced, or introduce unsafe prompt material that the skill later consumes.
The skill instructs the agent to pull files from a third-party repository and write them locally without an explicit warning that local files will be modified. This weakens informed consent and can enable surprising state changes, especially if the sync is triggered in normal conversational use or if the upstream repository becomes compromised.
The sync workflow allows external content retrieval and local file writes even though the primary skill purpose is SEO prompt guidance. That mismatch increases risk because users may invoke a seemingly informational skill without anticipating filesystem changes or ingestion of unreviewed third-party prompt files.
No suspicious patterns detected.
