Most static alerts are Markdown links, code fences, inline labels, or example URLs without executable behavior. Two shell examples accept unquoted URLs, and page auditing performs expected network fetches.
5
Files scanned
612
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Most static alerts are Markdown links, code fences, inline labels, or example URLs without executable behavior. Two shell examples accept unquoted URLs, and page auditing performs expected network fetches.
5
Files scanned
612
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Most static findings are false positives caused by Markdown fences, inline literals, example URLs, and fixed documentation links. Two command findings are confirmed because SKILL.md directs agents to run local Python helpers, and one network finding reflects intended page retrieval. User-controlled URLs lack visible private-network restrictions, so URL validation and structured command arguments are required.
User-provided URLs are passed to WebFetch and local helpers. The visible instructions do not block loopback, private, link-local, or metadata addresses.
The URL-driven commands are explicit, while only robots.txt handling is documented. Helper-level protections may exist but are not visible in the scanned files.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency local helpers** (no tool needed): `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connecto
This line instructs the agent to run local helper scripts with an unquoted user-supplied URL placeholder. Shell interpolation could enable argument or command injection.
**JS-rendering fallback (keyless)**: if `onpage.py` returns a near-empty body (client-side rendering
This line provides an executable Python command with an unquoted user-supplied URL placeholder. It creates local command and outbound network attack surfaces.
9. **Audit Page-Level Tags** — URL slug, canonical tag, and on-page schema presence. For deep crawl/
The line explicitly directs raw or rendered retrieval through WebFetch, curl, or onpage.py. It represents intended outbound access, although no exfiltration target is shown.
The audit de-noises Markdown fences, example URLs, metadata URLs, and fixed documentation links as false positives. Confirmed risks are limited to instructions that fetch user-provided pages or optionally run local helper scripts. No prompt injection, credential exfiltration, or malicious persistence evidence was found.
5
Files scanned
610
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency local helpers** (no tool needed): `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connecto
The line explicitly documents running python3 helper scripts against a URL. The helper appears legitimate, but executing local scripts with user-supplied URLs is a real external-command risk.
**JS-rendering fallback (keyless)**: if `onpage.py` returns a near-empty body (client-side rendering
The line documents a python3 Firecrawl helper invocation for scraping a user-provided URL. This is intended behavior, but it still executes local code and performs network retrieval.
9. **Audit Page-Level Tags** — URL slug, canonical tag, and on-page schema presence. For deep crawl/
The line references curl and onpage.py as raw-fetch options for page inspection. This is a limited command-use risk because it can fetch user-provided pages outside the model sandbox.
9. **Audit Page-Level Tags** — URL slug, canonical tag, and on-page schema presence. For deep crawl/
The skill instructs use of WebFetch or raw fetch tooling for user-supplied pages. That network access is core to the skill but should be constrained to public, consented URLs.
Most static findings are Markdown examples, relative documentation links, or metadata rather than active code. Two medium-confidence command findings are confirmed because the skill recommends local Python helper invocations with user-provided URLs. No prompt injection or malicious data-exfiltration intent was found.
5
Files scanned
610
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency local helpers** (no tool needed): `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connecto
The skill recommends running local Python helper commands with a user-supplied URL argument. This is legitimate SEO tooling but creates command execution and argument-safety risk.
**JS-rendering fallback (keyless)**: if `onpage.py` returns a near-empty body (client-side rendering
The skill recommends a Python scraping fallback with a user-supplied URL and network access. This expands execution surface and should require confirmation and safe argument handling.
Most static findings are Markdown examples, relative documentation links, or metadata rather than active code. Two medium-confidence command findings are confirmed because the skill recommends local Python helper invocations with user-provided URLs. No prompt injection or malicious data-exfiltration intent was found.
5
Files scanned
610
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency local helpers** (no tool needed): `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connecto
The skill recommends running local Python helper commands with a user-supplied URL argument. This is legitimate SEO tooling but creates command execution and argument-safety risk.
**JS-rendering fallback (keyless)**: if `onpage.py` returns a near-empty body (client-side rendering
The skill recommends a Python scraping fallback with a user-supplied URL and network access. This expands execution surface and should require confirmation and safe argument handling.
Most static alerts are false positives caused by Markdown links, prompt examples, public homepage metadata, and SEO terminology. I confirmed two medium-risk command-execution surfaces where the skill asks agents to run local Python helper scripts against supplied URLs. No prompt injection attempt, credential access, or data-exfiltration intent was found in the reviewed files.
5
Files scanned
610
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Zero-dependency local helpers** (no tool needed): `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connecto
The skill instructs running a repository-local python3 helper against a supplied URL. This is intentional tooling, but it is real local command execution and should require user confirmation and trust in the bundled script.
**JS-rendering fallback (keyless)**: if `onpage.py` returns a near-empty body (client-side rendering
The skill instructs running firecrawl.py scrape against a supplied URL, which combines local command execution with remote page retrieval. The workflow is legitimate for SEO, but it is a real command-execution surface.