seo-technical

SUSPICIOUS. The visible behavior mostly aligns with an SEO audit skill and the named external service/endpoints are consistent with official DataForSEO usage. However, the skill collects raw credentials through chat, writes them to a local .env file, and relies on unseen local scripts to handle and transmit those secrets. No third-party proxy or remote installer is shown, so this is not confirmed malicious, but the credential-handling pattern and opaque local tooling make the trust model weaker than a benign low-risk skill.