Versioned security assessment

Report ID: SA-9F22D902

7/7/2026, 5:25:01 PM

serp-analysis security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
serp-analysis
Version
v3
Maintainer
aaron-he-zhu
Source
github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/seo-geo/research/serp-analysis
Coverage
4 Files scanned · 416 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives from Markdown code fences, metadata URLs, and documentation links. The confirmed risks are external Python connector commands, optional environment API key use, and a mismatch between declared WebFetch-only tooling and connector-based network behavior.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

4 Files scanned · 416 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 8 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 17 evidence locations

Capability review items (3)
High
SKILL.md:49
Generic API/secret keys
**Zero-dependency live SERP (keyless)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/firecraw
Line 49 documents optional FIRECRAWL_API_KEY use by the connector, which may consume an environment credential for a third-party service. I found no evidence of credential exfiltration beyond intended API use, but secret access needs explicit disclosure and consent.
Medium
SKILL.md:49
Ruby/shell backtick execution
**Zero-dependency live SERP (keyless)**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/firecraw
The skill instructs users to run a Firecrawl Python connector with a user-supplied keyword and optional scraping. This is real external command execution with third-party network behavior, so it needs explicit permission and structured argument handling.
Medium
SKILL.md:51
Ruby/shell backtick execution
**Second keyless engine for corroboration**: `python3 "${CLAUDE_PLUGIN_ROOT}/scripts/connectors/tavi
The skill instructs users to run a Tavily Python connector with a user-supplied keyword and optional answer synthesis. This is external command execution that can contact a third-party service.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 High
SKILL.md:13SKILL.md:49-51
Declared Tool Boundary Mismatch
The skill declares allowed-tools: WebFetch, but later instructs users to run Firecrawl and Tavily Python connector commands for live SERP data. This creates a marketplace disclosure gap because users may expect WebFetch-only behavior while the skill can ask for shell-based network connectors.
The allowed tool declaration and connector commands are explicit in the same file. This context-level risk changes the expected permission boundary beyond the raw shell-command pattern.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Declared tool boundary mismatch
    Update allowed tools and marketplace disclosures to list external command and network connector behavior, or remove the connector instructions.
  2. FIX-002
    High
    Environment API key handling
    Document FIRECRAWL_API_KEY use clearly and require opt-in before any connector reads or sends an environment credential.
  3. FIX-003
    Medium
    External connector commands
    Replace shell examples with a host-approved structured tool call, or require explicit user confirmation before running the connector scripts.
  4. FIX-004
    Low
    Parent-directory documentation links
    Replace parent-directory links with packaged reference files or plain names so the skill does not imply access outside its bundle.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable