Security audit
Security checks for vulnerabilities and agentic risk
This SEO skill is purpose-aligned and disclosed, though users should understand it can stage SEO work and use approval-capable SEOmatic task tools.
Install only if you are comfortable connecting SEOmatic to your Search Console/site data and letting it stage SEO task cards. Review each staged task, cost label, and approval request carefully; do not approve a task unless you want SEOmatic to execute that specific site change.
The skill’s stated purpose is competitor-gap analysis, but the instructions extend into operational task staging and possible approval flows. This creates scope creep from analysis into action, increasing the chance an agent with available credentials could prepare or influence site-changing tasks that the user did not explicitly request in the context of a competitive analysis.
Including approval-capable workflow guidance in a competitor-gap skill is risky because it normalizes transition from insight generation to execution authority. Even though the text says not to approve on the user’s behalf, exposing task_manage approval-related capability in this context broadens the attack surface and could enable unsafe actions if an agent misinterprets user intent or is prompt-injected elsewhere.
No suspicious patterns detected.
