SEO + GEO Audit

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only SEO/GEO audit skill with expected website crawling and optional search API use, with no code or hidden behavior shown.

Before installing, confirm the target site and crawl size, provide a SerpAPI key only if you want search enrichment, and remember that reports without private analytics or Search Console should treat those data points as not verified.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may fetch and inspect public web pages and potentially crawl internal links for the requested site.

Why it was flagged

The skill expects network/page access and audit tooling, which is central to an SEO/GEO audit but should be scoped to sites the user is authorized to review.

Skill content

Collect factual findings from live pages, crawl data, page source, rendered output, and any available audit tooling.

Recommendation

Use clear target URLs or domains, set a reasonable crawl cap, and avoid auditing sites where you do not have permission or a legitimate reason.

Low

#ASI03: Identity and Privilege Abuse

What this means

If configured, the agent could use the user's SerpAPI account for search-result enrichment, which may incur usage or expose query activity to that provider.

Why it was flagged

The artifact discloses optional use of a third-party search API key; this is expected for search enrichment but is still a credential the user should manage carefully.

Skill content

`SERPAPI_API_KEY`: optional for broader search visibility checks or search-result enrichment

Recommendation

Use a limited-scope API key where possible, monitor provider usage, and do not provide unrelated analytics or private platform credentials unless explicitly needed.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user may be unsure whether the skill needs SerpAPI or python3 before use, though the rest of the artifacts say the audit can run without private integrations.

Why it was flagged

The SKILL frontmatter lists an API key and python3 as requirements, while the surrounding text and manifest describe them as optional and the registry lists no required env vars or binaries.

Skill content

primaryEnv: SERPAPI_API_KEY
  requires:
    env:
      - SERPAPI_API_KEY
    bins:
      - python3

Recommendation

Treat SerpAPI and python3 as optional unless your runtime explicitly uses them, and prefer updating metadata so registry requirements match the documented optional behavior.