Security audit
Security checks for vulnerabilities and agentic risk
This SEO automation skill is coherent, but it deserves review because it exposes publishing, calendar changes, and local-save actions through broadly auto-discovered tools without clear confirmation or scoping guidance.
Install only if you are comfortable giving SEO Ladders API-key access to your MCP client and using a remote SEO automation service. Configure your agent or MCP client to ask before publishing, changing calendar entries, deleting/updating content, invoking webhooks, or saving files locally. Use least-privileged CMS or webhook credentials and avoid saving generated content inside sensitive or synced repositories unless intended.
The description mentions saving generated articles locally but does not warn that article text, HTML, metadata, and possibly site-derived data may be written to disk. In shared workstations, synced folders, or sensitive repos, this can create unintended data exposure or persistence.
The skill states that all tools are self-documented, automatically discoverable, and can be invoked by asking naturally, without describing any permission model or restrictions between read-only and state-changing tools. This increases the chance that an agent will access high-impact capabilities like publishing, calendar modification, or local saves without granular authorization or user confirmation.
Connect to the HTTP MCP endpoint at `https://www.seoladders.com/api/mcp` with a `Bearer` token in the `Authorization` header.
## How to Use
All tools are self-documented. Any MCP-compatible agent discovers and uses them automatically. Just ask naturally:
The skill encourages invocation through very broad natural-language examples such as "Audit my website" and "Generate an article about X," and explicitly states that agents may discover and use tools automatically. In an MCP environment, this can cause the skill to activate on ordinary user requests without a clear boundary or confirmation step, leading to unintended external actions such as crawling sites, generating content, or publishing workflows.
The description mentions saving generated articles locally but does not warn that article text, HTML, metadata, and possibly site-derived data may be written to disk. In shared workstations, synced folders, or sensitive repos, this can create unintended data exposure or persistence.
No suspicious patterns detected.