claude-seo

SUSPICIOUS. The skill is broadly coherent for SEO image generation and does not show overt exfiltration or malicious mismatch, but it depends on a separately installed extension that in turn configures a third-party MCP package which may receive the user’s Google API key. Same-org/local install references reduce concern, yet the transitive trust chain and likely unpinned npm execution make this a medium-risk skill rather than benign.