!
Purpose & Capability
The SKILL.md and analyze.sh implement an SEO audit that uses an LLM agent (calls `openclaw agent`) to produce reports. However the skill metadata declares no required binaries or credentials, while analyze.sh depends on an external CLI (`openclaw`) and python3. That mismatch between what the skill says it needs and what it actually runs is an incoherence.
ℹ
Instruction Scope
SKILL.md stays focused on SEO/GEO tasks and the analyze.sh script only accepts keyword/URL/content and forwards a constructed prompt to an agent. However the SOP explicitly recommends tactics that attempt to avoid link disclosure (e.g., 'No rel="sponsored" or rel="ugc"', 'No subdomain placement — main domain only', 'pillow links', forum/comment/Quora link quotas), which can promote behavior that violates search-engine policies and raises ethical/abuse concerns. The instructions also rely on a Claude-based workflow but do not document how Claude is accessed or authorized.
✓
Install Mechanism
No install spec is provided (instruction-only with a helper script). That is low-risk from an installation perspective — nothing is downloaded or extracted. The only file is a shell script which will run locally if executed.
!
Credentials
The skill declares no required environment variables or primary credential, but the script invokes `openclaw agent --local` and pipes a potentially large prompt containing user-provided page content to it. That will transmit content to whatever model/back-end `openclaw` is configured to use. Because no credentials or model endpoint are declared, it's unclear where data will be sent and which account/keys would be used — this is a proportionality and transparency issue.
✓
Persistence & Privilege
The skill does not request permanent presence (always:false) and is user-invocable only. It does not modify other skills or system-wide settings. Autonomous invocation is enabled by default but is not combined with other high-privilege requests.
What to consider before installing
What to check before installing or running this skill:
- Missing dependency transparency: The script calls `openclaw agent` and `python3` but the skill metadata lists no required binaries or credentials. Verify whether your environment has an `openclaw` CLI and what account/model it will use; if you don't control that, do not run the script with sensitive content.
- Data exfiltration risk: analyze.sh sends the page content and prompt to an agent. Any content you pass (including private page text, internal URLs, or competitor data) will be transmitted to whatever model/back-end the CLI uses. Only run it if you understand and trust that endpoint and its privacy/security model.
- SEO policy/ethics: The SOP recommends tactics that can skirt search-engine disclosure (e.g., avoiding rel='sponsored'/'ugc', 'pillow links', forum/Quora link quotas). Those can violate search engine guidelines and could harm your site. Treat backlink/guest-post recommendations with caution and consult your legal/SEO policy advisor.
- Verify the upstream project and author: The homepage points to a GitHub repo — inspect that repo, check commits, issues, and author reputation. Confirm the registry owner identity if you need accountability.
- Safe testing: If you want to try it, run the script in an isolated environment with example/non-sensitive content, and monitor network calls (so you can see where data goes). Prefer manual prompt usage in a controlled client you trust rather than blind execution.
If you want, I can:
- show the exact lines in analyze.sh that call external tools and what variables would be transmitted, or
- suggest a safer wrapper that logs where data would be sent before executing.
