seo-team-the-doctor

SUSPICIOUS: the SEO-audit behavior itself is coherent and the prompt-injection findings are low-risk workflow artifacts, but the skill’s trust model is not. It requires an ambiguously sourced external CLI and forwards a DataForSEO API key to it, which triggers high supply-chain and credential-forwarding risk despite an otherwise proportional purpose.