GEO Pulse — Brand AI Visibility Intelligence

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent reporting skill, but using it will send brand names to an external HTTP service that may store them and run multi-platform AI queries.

Before installing, verify that you trust the GEO Pulse API endpoint and consider setting GEO_PULSE_BASE_URL to a trusted HTTPS service. Use public brand/domain information unless you understand the service's retention and downstream provider policies, and confirm before allowing first-time brand onboarding or long-running pipeline execution.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

When a brand is not already known, the agent may submit it to the GEO Pulse service and start external processing to generate the report.

Why it was flagged

The workflow creates a remote brand record and starts a long-running AI-search pipeline as part of normal report generation. This is purpose-aligned but changes remote state and may run for several minutes.

Skill content
curl -s -X POST "$BASE_URL/api/brands" ... curl -s --max-time 600 -X POST "$BASE_URL/api/pipeline/ai-search"
Recommendation

Confirm with the user before first-time onboarding, especially for non-public or client-sensitive brand names.

What this means

Brand queries and returned report data could pass through an endpoint the user has not independently verified, and HTTP traffic may be easier to observe or tamper with than HTTPS.

Why it was flagged

The skill depends by default on a public raw-IP HTTP endpoint. This dependency is disclosed and central to the purpose, but the artifact does not provide provenance or HTTPS transport for the default service.

Skill content
BASE_URL="${GEO_PULSE_BASE_URL:-http://8.148.223.19:8000}"
Recommendation

Use a verified trusted endpoint, preferably HTTPS, by setting GEO_PULSE_BASE_URL before using the skill with sensitive business information.

What this means

Submitted brand names or domains may be processed by the GEO Pulse service and possibly downstream AI/search platforms.

Why it was flagged

The skill is designed to route brand-analysis work through a service that performs multi-platform AI queries. This is expected for GEO analysis, but provider boundaries and downstream handling are not described.

Skill content
measures AI search visibility across ChatGPT / Perplexity / Qwen / DeepSeek style outputs ... running multi-platform AI queries
Recommendation

Avoid submitting confidential launch names, private client identifiers, or sensitive competitive plans unless the endpoint operator and downstream handling are trusted.

What this means

Brand records and metrics may remain available for future trend reports after the initial request.

Why it was flagged

The workflow creates remote brand records and supports historical snapshots. Persistence is purpose-aligned for trend reports, but retention and deletion controls are not described in the artifact.

Skill content
Create brand record ... /api/brand-metrics/history ... days=90
Recommendation

Treat submitted brand data as remotely retained unless the service owner provides deletion and retention guarantees.