seo-aeo-geo-audit

This module functions as an orchestrator rather than a self-contained malware payload: it reads workspace files, then either executes a local target agent executable via subprocess (with TARGET_AGENT_COMMAND fully controlling which binary runs) or sends workspace prompt/input (and optional skill/checks) to OpenRouter over HTTPS and validates that the response returns a JSON audit artifact. No clear covert or destructive behavior is present in the fragment, but security risk is non-trivial due to environment-driven arbitrary command execution and intentional third-party data egress of workspace content (including use of an API key for outbound authorization).