Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AI SEO Optimizer Pro
v1.0.0企业级SEO工具，提供关键词研究、内容优化、排名追踪及自动内链建议，助力提升网站搜索排名和流量。
⭐ 0· 56·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the code: modules for keyword research, content analysis, rank tracking and internal linking exist. However multiple parts of the code use mocked/stubbed data (e.g., content fetch returns a placeholder, web-search returns simulated results, competitor analysis comments imply external API calls but only generates random/mock data). The marketing claims about real-time Google data and 'enterprise' features are disproportionate to the actual implementation.
Instruction Scope
SKILL.md instructs the agent to analyze URLs and pages, but the runtime code does not actually fetch page content or call live search APIs (ContentAnalyzer._fetchContent returns a placeholder and WebSearch._performSearch returns synthetic mock results). That mismatch means instructions/usage examples promise behavior the code will not perform. SKILL.md itself does not request unrelated files, env vars, or endpoints.
Install Mechanism
No install specification or external downloads. package.json lists no dependencies. There is no installer that would fetch arbitrary remote code. This lowers technical attack surface.
Credentials
The skill requests no environment variables, binaries, or config paths. No credentials are required or declared, which is proportionate to the provided (local, mock) functionality.
Persistence & Privilege
Flags show always:false and normal autonomous invocation allowed. The skill does not request permanent presence or modify other skills. No elevated privileges are declared.
What to consider before installing
This package contains self-contained JS modules for SEO tasks but most network-dependent functionality is mocked/stubbed. Key points to consider before installing or paying:
- Functionality mismatch: Content fetching and web search are stubbed; analyzing a real URL will not retrieve the actual page content nor perform live Google SERP queries. The README/SKILL.md marketing ("based on latest Google algorithms", "real-time competition analysis") is misleading relative to the code.
- Source / trust: Source/homepage are unknown or placeholders (support@example.com, docs.example.com). The repository URL in metadata is generic. Verify the author's identity and a trustworthy upstream repository before use in production.
- Low technical risk: There are no external downloads, no required environment variables, and no obvious data-exfiltration code. Still, because the implementation is mocked, do not rely on it for real SEO measurements.
- Actions you can take: (1) Ask the author for a link to the canonical repo or a demo that shows live search integration. (2) Inspect or run the code in a sandbox to confirm network behavior — check whether _fetchContent and _performSearch get replaced/implemented. (3) If you need real live data, require explicit evidence of real search API integration and credentials handling (and ensure any credentials are scoped and stored securely). (4) Avoid paying or integrating this as an enterprise service until the live-data behavior is confirmed.
If you want, I can: (a) point out the exact lines that are mocked/stubbed, (b) suggest minimal code changes to add real HTTP fetches and where to insert API keys, or (c) produce a checklist of signals to verify a trustworthy SEO skill/provider.Like a lobster shell, security has layers — review code before you run it.
aivk97ftdnbp33q6wn2kv1z97wn8s83c6e5latestvk97ftdnbp33q6wn2kv1z97wn8s83c6e5marketingvk97ftdnbp33q6wn2kv1z97wn8s83c6e5seovk97ftdnbp33q6wn2kv1z97wn8s83c6e5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.