Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed SEO auditing and optimization helper with bounded public-site fetching and user-confirmed edits, and I found no hidden persistence or unrelated behavior.
Install only if you want an agent to perform SEO audits and, with your confirmation, edit website SEO files such as robots.txt, sitemap.xml, canonical tags, schema, or content. Review proposed production SEO changes before applying them because mistakes can affect indexing and traffic.
Referenced artifact was not completely inspected
- `Bash`：**用途被限定死** —— 只用于在本地运行本技能自带的只读审计脚本 `node scripts/seo-audit.js <domain>`，以及 `node --check scripts/seo-audit.js` 这类语法自检；不执行由用户输入拼出的任意命令、不读密钥或凭据文件、不改系统配置、
Referenced artifact was not completely inspected
- `Bash`：**用途被限定死** —— 只用于在本地运行本技能自带的只读审计脚本 `node scripts/seo-audit.js <domain>`，以及 `node --check scripts/seo-audit.js` 这类语法自检；不执行由用户输入拼出的任意命令、不读密钥或凭据文件、不改系统配置、
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Features
- 🔍 **audit — full-site technical SEO**: crawlability & indexation → technical foundations → on-page → content quality → authority/links, graded 🔴🟠🟡, each item with Issue / Impact / Evidence / Fix / Verify
- 📄 **page — deep single-URL analysis**: title / meta description / H1 structure / keyword placement / image alt / internal links, with copy-paste rewrite suggestions
- ✍️ **content — quality & keywords**: search-intent classification, keyword research (incl. AI fan-out), E-E-A-T signals, keyword cannibalization checks
- 🧩 **schema — structured data**: JSON-LD templates for common types + browser-render detection (static fetches miss JS-injected schema)
- 🤖 **geo — AI search (AEO/GEO)**: llms.txt, AI bot list & robots policy, `/pricing.md` for AI buying agents, Princeton GEO quantified methods
The language selector marks Chinese as the default presentation and links out to English, which can be read as imposing a specific language unless the user notices and follows the alternate-language link. Under the policy rule, forcing a specific language without explicit user opt-in can be a natural-language policy concern.
Line L08 states that the site's content language is Chinese and that it primarily publishes in Chinese. Under the policy rule, language constraints can be a violation when they force a specific language without user opt-in; this line does not present language choice to the user.
Line L08 states that the site's products and descriptions are published for Chinese readers, which imposes a language/locale constraint. While it mentions English materials may be requested, it does not present language choice or opt-in as part of the skill behavior.
This plain-text file describes the site, pages, and content policy, but it does not define any explicit trigger phrases, activation boundaries, or exclusion conditions for when a related skill should be invoked. For skill-routing contexts, that lack of specificity can lead to overly broad matching based on general product references like '小遥AI' or '技能生态'.
The visible skill text includes a bilingual label (Chinese and English) but does not indicate that language presentation is optional or user-selectable. Under the policy rule, forcing a specific language or locale presentation without user opt-in can be a natural-language policy concern.
No suspicious patterns detected.