The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill manages DataForSEO API credentials by prompting the user and storing them in ~/.claude/skills/seo/.env. It follows security best practices by applying chmod 600 to the file to restrict access and explicitly instructing the agent not to echo credentials in tool outputs or commits.
[COMMAND_EXECUTION]: Executes local scripts (preflight.sh, keyword_research.py) and standard tools (chmod, Bash) to verify the environment and run SEO analysis tasks.
[EXTERNAL_DOWNLOADS]: References the well-known DataForSEO API service (dataforseo.com) for SEO data retrieval. These references are documented neutrally and correspond to the skill's primary function.
[PROMPT_INJECTION]: The skill ingests untrusted user data in the form of domain names (<domain>) which are passed to subagents. While this creates a surface for indirect prompt injection, it is a standard functional requirement for an SEO tool and is mitigated by the structured nature of the tasks.
Ingestion points: The <domain> variable is interpolated into prompts for keywords, technical, competitor, content, and backlink subagents.
Boundary markers: No explicit delimiters are used to wrap the domain input in the subagent instructions.
Capability inventory: The skill uses Bash, Write, Read, and Agent tools across its lifecycle.
Sanitization: No explicit sanitization or validation of the domain string is mentioned in the markdown instructions.

seo-audit