Brand Geo Master

Brand GEO Master — AI Platform Brand Visibility Monitor. Automatically search AI platforms (Kimi/Xunfei/Zhipu/Wenxin/DeepSeek/etc.), detect brand keyword vis...

Security Scan

The skill's code generally matches the described monitoring purpose, but there are several incoherences and privacy/network-exfiltration concerns (billing to skillpay.me, Feishu webhook, Playwright dependency) that merit review before installation.

Purpose & Capability

The skill claims to be a local AI-platform visibility monitor, which aligns with the crawling, scoring, and reporting code. However, the public registry metadata lists no required environment variables while SKILL.md and the code require billing-related environment variables (FEISHU_USER_ID, SKILL_BILLING_API_KEY, SKILL_BILLING_SKILL_ID) — a clear metadata/instruction mismatch. The billing integration (SkillPay.me) and its requirement for a billing API key is not obvious from the registry metadata and is not strictly necessary for local crawling, so the billing dependency is disproportionate to a purely-local monitor.

Instruction Scope

The runtime instructions & scripts run Playwright to drive web pages (network I/O), call out to external endpoints via requests/curl (skillpay.me billing API and Feishu webhook), and may transmit FEISHU_USER_ID to a third party for billing. The analyzer optionally calls an external AI endpoint if configured. The SKILL.md instructs users to run python scripts which will perform network requests and push data externally — those behaviors are within the code but extend beyond a purely local-only scan and could leak identifying data to third-party services.

Install Mechanism

No install specification is provided in the registry (instruction-only), yet the code requires Playwright (and the Playwright browsers) and uses requests and subprocess/curl. The geo_searcher exits if playwright is missing and prints installation instructions, which is OK but fragile: lack of an explicit install spec means automated environments might silently fail or require manual browser installation (playwright install). There are no remote downloads embedded in the skill files themselves.

Credentials

SKILL.md lists FEISHU_USER_ID, SKILL_BILLING_API_KEY, SKILL_BILLING_SKILL_ID and GEO_QUOTA_FILE as required. Those vars are used for billing and quota bookkeeping; FEISHU_USER_ID is explicitly transmitted to skillpay.me per the docs. Requiring a billing API key and a user identifier is reasonable for a pay-per-call model, but the registry metadata advertised 'Required env vars: none' which is inconsistent. Sensitive credentials (billing API key, user open_id) are requested and result in external network calls — users should verify they trust skillpay.me and the skill owner before providing them.

Persistence & Privilege

The skill does not request permanent 'always' inclusion and does not alter other skills. It writes a local quota file (.geo_quota.json) and saves reports to /tmp; that is normal for a CLI-like tool. It dynamically imports its modules and uses local files only; no special system-wide privileges are requested.

What to consider before installing

Key things to check before installing: - Metadata mismatch: the registry claims no env vars, but SKILL.md and the code require FEISHU_USER_ID, SKILL_BILLING_API_KEY, and SKILL_BILLING_SKILL_ID for billing. Don't provide sensitive credentials unless you trust the skill author and SkillPay.me. - External data flows: the skill will call skillpay.me for billing (and can transmit FEISHU_USER_ID) and will POST reports to a Feishu webhook if configured. If you do not want any identifying data sent out, run in an isolated environment and omit the billing/env vars and Feishu webhook. - Playwright dependency: the code requires Playwright and browser binaries (pip install playwright && playwright install). Because there is no install spec, be prepared to manually install those and run the skill in a controlled environment; headless browsers perform real network requests. - Privacy & trust: review config.json (feishu_webhook, platforms) and confirm you are comfortable with the external endpoints (skillpay.me, Feishu webhook). Consider running the code locally with network blocked or using a traffic inspector (proxy) to see what is transmitted. - What would reduce suspicion: updated registry metadata that declares required env vars and a clear install spec for Playwright, and explicit privacy docs describing exactly what is sent to skillpay.me and when. If those are provided, the skill would appear coherent and likely benign. If you are not comfortable with these external calls or providing billing credentials, do not install or run this skill, or run it in an isolated sandbox/VM and inspect network traffic first.

Detect your brand's visibility across AI search platforms, generate scores and optimization recommendations.

---

Core Features

• Multi-platform detection: Search 9 AI platforms simultaneously
• GEM Score: 0-100 visibility score with grade classification
• AI Reason Analysis: Understand why brand is not recommended
• Feishu Push: Auto-send report as interactive card
• No API key required: Local Playwright for free tier

---

Quick Start

# Detect a single brand
python3 scripts/geo_report.py "Brand Name"

# Detect multiple brands (including competitors)
python3 scripts/geo_report.py "Brand A" "Brand B"

# No Feishu push (for debugging)
python3 scripts/geo_report.py "Brand Name" --no-push

# Check quota status
python3 scripts/geo_report.py --status

---

Score Guide

Score	Level	Description
80-100	Excellent	AI actively recommends, strong brand exposure
60-79	Good	Mentioned by some AI platforms
30-59	Fair	Rare mentions, needs optimization
0-29	Weak	Completely invisible

---

Platform Coverage

Platform	Coverage
Kimi	Supported
Xunfei	Supported
Wenxin	Supported
Zhipu	Supported
DeepSeek	Supported
Qwen	Supported
Doubao	Supported
Mita	Supported
Hunyuan	Supported

---

Config File

Config is at config.json:

{
  "platforms": {
    "kimi": {"enabled": true, "weight": 1.0},
    "xinhuo": {"enabled": true, "weight": 0.9},
    "yiyan": {"enabled": true, "weight": 0.9},
    "zhipu": {"enabled": true, "weight": 0.8},
    "deepseek": {"enabled": false},
    "qianwen": {"enabled": false},
    "doubao": {"enabled": false},
    "mita": {"enabled": false},
    "hunyuan": {"enabled": false},
    "xunfei": {"enabled": false}
  },
  "report": {
    "push_to_feishu": true,
    "feishu_webhook": "Your Feishu group bot webhook URL"
  }
}

---

Billing

• Pay-per-call: $0.0100 USDT per execution via SkillPay.me
• Balance insufficient: Payment URL returned — user tops up at https://skillpay.me/brand-geo-master
• External data flow: FEISHU_USER_ID transmitted to skillpay.me for billing identification
• Billing model: Each full scan (single brand or batch) = 1 call = $0.0100 USDT

---

Required Environment Variables

Variable	Description
FEISHU_USER_ID	User open_id for billing (passed by Feishu runtime)
SKILL_BILLING_API_KEY	SkillPay Builder API Key
SKILL_BILLING_SKILL_ID	SkillPay Skill ID (defaults to brand-geo-master)
GEO_QUOTA_FILE	Path to quota file (defaults to .geo_quota.json)

---

License

MIT