seobuild-onpage

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/setup.py file uses subprocess.check_call to install required Python dependencies (specifically the requests library) into the local environment. This is a standard setup procedure.
  • [COMMAND_EXECUTION]: The SKILL.md file contains instructions for the agent to execute shell command blocks for environment discovery, such as locating the skill's root directory. These commands are benign and necessary for cross-platform compatibility.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to modify the project's codebase, including updating framework configuration files (e.g., .htaccess, next.config.js) to implement SEO-recommended redirects and 410 status codes. The instructions include guidelines to ensure developer oversight during these modifications.
  • [DATA_EXFILTRATION]: The skill transmits search keywords and user-provided API credentials to DataForSEO and Google Search Console services. This network activity is the primary function of the research pipeline and targets well-known service providers.
  • [CREDENTIALS_UNSAFE]: API credentials for third-party services are managed through a local environment file located at ~/.config/seo-agi/.env. This centralized storage is a standard approach for managing secrets in local development tools.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 12:04 AM
Security Audit — agent-trust-hub — seobuild-onpage