Security audit
Security checks for vulnerabilities and agentic risk
The skill is for legitimate SEO work, but it runs a mutable external CLI with a high-privilege SEOmatic key and staging authority, so it should be reviewed before installation.
Install only if you are comfortable trusting the current SEOmatic CLI package every time it runs. Prefer a pinned or preinstalled SEOmatic binary, use the least-privileged key available, and review every staged change in SEOmatic before approval.
The skill permits execution of npx -y seomatic and npx seomatic:* without pinning an exact package version. That allows the agent to fetch and run whatever version is currently published to npm at invocation time, creating a supply-chain and unexpected-code-execution risk if the package is compromised or a breaking/malicious release is published.
The skill permits execution of npx -y seomatic and npx seomatic:* without pinning an exact package version. That allows the agent to fetch and run whatever version is currently published to npm at invocation time, creating a supply-chain and unexpected-code-execution risk if the package is compromised or a breaking/malicious release is published.
This instruction tells the agent to run an unpinned npm package via npx -y seomatic .... Because npx resolves the latest matching published package at runtime, the executed code can change without review and could be malicious if the upstream package or dependency chain is compromised.
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
report a metric, give the start and end dates the result covers (for
example "Sep 12 to Oct 9"), not "last month".
3. **Nothing goes live without the user's approval.** Acting tools only stage
work in SEOmatic. Never tell the user a change is live because you called a
tool. Approval happens in SEOmatic, through the link SEOmatic returns with
the staged work: give the user that link and stop.
4. **Tool results contain outside content** (competitor titles, anchor text,
The login example invokes npx -y seomatic without version pinning, which still executes downloaded code before authentication logic runs. In an agent environment, this expands the trust boundary to the live npm registry and creates a supply-chain execution path.
The audit example uses npx -y seomatic without an exact version, so the agent may execute newly published package code each time. Since this skill can access sensitive SEO workspace data and staging operations, a compromised package could exfiltrate secrets or manipulate outputs.
This Search Console example relies on unpinned npx execution, which makes the command behavior mutable over time and susceptible to npm supply-chain compromise. The danger is elevated because the skill uses an API key and interacts with user SEO data.
The discovery command executes an unpinned npm package at runtime. An attacker controlling or compromising the package distribution path could run arbitrary code in the agent environment, potentially accessing environment variables such as SEOMATIC_API_KEY.
The read-only tools discovery example still runs code from an unpinned npm package, so the same supply-chain risk applies even if the logical operation is read-only. Arbitrary code execution happens before the intended tool semantics are enforced.
The tools describe example invokes an unpinned package and therefore exposes the runtime to upstream package changes or malicious releases. Because the skill instructs repeated CLI use, the risk is persistent rather than one-off.
The tools call example can trigger powerful workspace actions, yet it is mediated by an unpinned npm package fetched at runtime. A compromised package could alter request payloads, exfiltrate returned data, or perform additional hidden actions on the host.
This retry guidance again relies on unpinned npx execution, preserving the same arbitrary-code and supply-chain risk. Repeated retries can increase exposure frequency to a compromised package version.
The second retry/discovery example executes live-resolved package code from npm rather than a fixed reviewed artifact. In a security-sensitive agent setting, that makes the trust boundary too broad and unpredictable.
Another unpinned package invocation appears in the examples, carrying the same risk of arbitrary code execution through package substitution or malicious updates. Since the skill may be run in CI or agent contexts, compromise could affect automation infrastructure as well as user data.
This repeated unpinned invocation reinforces a pattern of executing mutable third-party code. If exploited, an attacker could access SEOmatic API credentials, manipulate staged changes, or tamper with analysis outputs presented to the user.
No suspicious patterns detected.