seobuild-onpage
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/setup.pyfile usessubprocess.check_callto install required Python dependencies (specifically therequestslibrary) into the local environment. This is a standard setup procedure. - [COMMAND_EXECUTION]: The
SKILL.mdfile contains instructions for the agent to execute shell command blocks for environment discovery, such as locating the skill's root directory. These commands are benign and necessary for cross-platform compatibility. - [COMMAND_EXECUTION]: The skill provides instructions for the agent to modify the project's codebase, including updating framework configuration files (e.g.,
.htaccess,next.config.js) to implement SEO-recommended redirects and 410 status codes. The instructions include guidelines to ensure developer oversight during these modifications. - [DATA_EXFILTRATION]: The skill transmits search keywords and user-provided API credentials to DataForSEO and Google Search Console services. This network activity is the primary function of the research pipeline and targets well-known service providers.
- [CREDENTIALS_UNSAFE]: API credentials for third-party services are managed through a local environment file located at
~/.config/seo-agi/.env. This centralized storage is a standard approach for managing secrets in local development tools.
Audit Metadata