seo-drift
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
seo_drift.py) to process SEO snapshot data. The script is located within the plugin's root directory and operates on CSV files stored in the plugin's data directory. This is standard behavior for data analysis skills. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses brand profile data and SEO CSV exports stored in
~/.claude-marketing/and${CLAUDE_PLUGIN_DATA}. These operations are local to the user's environment and intended for the skill's primary purpose of SEO auditing. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from CSV files (GSC exports, rank trackers). While this presents an ingestion surface, the risk is minimized by the skill's workflow, which passes the data through a Python script for structured processing and generates fixed-format markdown reports rather than executing commands directly based on CSV content.
- [SAFE]: The skill demonstrates security best practices by implementing a 'Quality scorecard' that validates data compatibility, sample size, and non-overlapping date ranges before proceeding with the analysis.
Audit Metadata