GEO Optimization

PassAudited by ClawScan on May 1, 2026.

Overview

This is mostly a GEO content-optimization guide; optional monitoring scripts are related but use a Perplexity API key, external API calls, and local history files if run.

The content guidance itself is low-risk. Only run the monitoring scripts if you intend to use a Perplexity API key, send the listed queries to Perplexity, and store local result history; edit the hardcoded workspace path and Gameye-specific queries before reusing the automation.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you run the monitor, it will use a local Perplexity API key and may consume that account's API quota.

Why it was flagged

The monitor imports values from a local .env file and uses a Perplexity API key. This is expected for Perplexity monitoring, but users should notice that the registry requirements declare no required credentials.

Skill content

env_path = Path(__file__).parent.parent / ".env" ... os.environ[key] = value ... api_key = os.getenv("PERPLEXITY_API_KEY")

Recommendation

Use a scoped Perplexity key, keep unrelated secrets out of the working .env where practical, and only run the scripts when you intend to perform API-backed monitoring.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Queries may be shared with Perplexity and could incur usage costs under the configured API key.

Why it was flagged

Running the monitor sends test queries to Perplexity's API. This is aligned with the GEO monitoring purpose, but it is an external API operation.

Skill content

requests.post("https://api.perplexity.ai/chat/completions", headers={"Authorization": f"Bearer {api_key}" ...}, json={"model": "sonar-pro", "messages": [{"role": "user", "content": query}]}, timeout=30)

Recommendation

Review the query list before running bulk tests and avoid putting confidential business information in ad hoc queries.

Info

#ASI06: Memory and Context Poisoning

What this means

Local history files may retain competitive research queries or other sensitive prompt text if you include it.

Why it was flagged

The monitor stores queries, returned Perplexity content, citations, and analysis locally for later reporting.

Skill content

history_dir = Path("geo-history") ... data = {"query_id": query_id, "query": query, "timestamp": timestamp, "result": result, "analysis": analysis} ... json.dump(data, f, indent=2)

Recommendation

Treat geo-history as local working data, avoid sensitive queries unless needed, and delete or protect the history directory when appropriate.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The helper may fail, run from an unintended directory, or require editing before it is safe and useful in another workspace.

Why it was flagged

The daily helper script contains a hardcoded personal workspace path, showing that the included automation is tailored to one environment rather than packaged as a generic installable workflow.

Skill content

WORKSPACE="/Users/awalker/clawd"
cd "$WORKSPACE"
python3 scripts/geo-monitor.py --test

Recommendation

Inspect and adapt the scripts, paths, and Gameye-specific query set before scheduling or relying on the monitoring automation.