seo-flow
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a
/seo flow synccommand that executes a local script namedsync_flow.pyvia theclaude-seoruntime to manage file updates. - [EXTERNAL_DOWNLOADS]: The synchronization logic fetches prompt updates from the official public GitHub repository for the FLOW framework (
github.com/AgriciDaniel/flow). This is a user-initiated administrative action for the skill. - [PROMPT_INJECTION]: The skill processes user-supplied URLs and topics through a variety of SEO templates, which presents a surface for indirect prompt injection. This risk is mitigated by the inclusion of a checksum file (
references/flow-prompts.lock) that uses SHA-256 hashes to ensure the integrity of the prompt library files. - [SAFE]: The reference materials and bibliography consistently cite well-known and authoritative services such as Google Search Central, Ahrefs, Backlinko, and the SEC for SEO claims and behavioral data.
Audit Metadata