AEO Prompt Question Finder

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it claims—query autocomplete suggestions, with optional search-volume enrichment—while clearly disclosing the main external services and optional credential use.

This skill is reasonable for autocomplete and AEO keyword research. Before installing or using it, be aware that query topics are sent to Google, and enabling --volume also uses DataForSEO credentials and sends keyword lists to DataForSEO. Avoid sensitive topics if those external data flows are not acceptable.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If the user enables --volume, the skill can use the user's DataForSEO account credentials to request keyword volume data.

Why it was flagged

The optional search-volume feature reads DataForSEO credentials from environment variables or macOS Keychain before calling the DataForSEO API. This is disclosed and purpose-aligned, but it is still credential use.

Skill content

login = os.environ.get("DATAFORSEO_LOGIN") or get_keychain("dataforseo-login")
password = os.environ.get("DATAFORSEO_PASSWORD") or get_keychain("dataforseo-password")

Recommendation

Use --volume only when intended, prefer dedicated DataForSEO credentials if possible, and verify the Keychain entries or environment variables point to the account you expect.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Search topics and generated keyword phrases may be shared with Google and optionally DataForSEO.

Why it was flagged

The script sends the user's topic-derived queries to Google Autocomplete and, when --volume is used, sends generated keywords to DataForSEO. These external calls match the skill's purpose but are a privacy-relevant data flow.

Skill content

BASE_URL = "https://suggestqueries.google.com/complete/search"
url = "https://api.dataforseo.com/v3/keywords_data/google_ads/search_volume/live"

Recommendation

Avoid using private, confidential, or regulated topics unless you are comfortable sending those query terms to the relevant external providers.