SEO + GEO Content Engine

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only SEO writer appears purpose-aligned and includes no code, but it can use a search API key and a Google Sheets tracker if you configure them.

This appears safe to install as an instruction-only content workflow. Before using live integrations, provide only the specific SerpAPI key or read-only/public Google Sheet you want it to use, and do not run any future helper scripts unless you have reviewed them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If configured, the skill may use your SerpAPI quota and read keyword-tracker data from the provided sheet.

Why it was flagged

The skill may use an API key and a Google Sheets tracker URL to access external services. This is aligned with SERP analysis and keyword backlog checking, and the artifact recommends minimal/read-only access.

Skill content
`SERPAPI_API_KEY`: recommended for live SERP retrieval and structured search results; `GOOGLE_SHEETS_TRACKER_URL`: optional keyword tracker source; prefer a read-only or public sheet
Recommendation

Use a scoped SerpAPI key and a read-only or public tracker URL; avoid providing writable or unrelated private sheet access unless you specifically intend that.

What this means

Users may not see all setup expectations from the registry metadata alone, and python/helper-script references should be treated carefully if added later.

Why it was flagged

The skill text declares environment variables and a binary, while the package metadata supplied to the scan lists no required env vars, binaries, or install spec. This is an under-declared setup/provenance gap, not evidence of hidden code.

Skill content
requires: env: - SERPAPI_API_KEY - GOOGLE_SHEETS_TRACKER_URL; bins: - python3
Recommendation

Read the skill instructions before use, treat integrations as optional unless deliberately configured, and verify any helper scripts separately before running them.