Versioned security assessment

Report ID: SA-27BA3BBB

6/30/2026, 11:26:46 AM

seo-geo security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
seo-geo
Version
v2
Maintainer
resciencelab
Source
github.com/resciencelab/opc-skills/tree/main/.agents/skills/seo-geo/
Coverage
18 Files scanned · 3,098 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many command, network, and weak-crypto patterns, but most weak-crypto and backtick matches are markdown examples or false positives. Real risk comes from scripts that fetch arbitrary URLs, call DataForSEO with environment credentials, and documentation that includes shell command examples.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

18 Files scanned · 3,098 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Capability review items (3)
Medium
scripts/seo_audit.py:14-20scripts/seo_audit.py:62-66scripts/seo_audit.py:78-82scripts/seo_audit.py:90-102
Network Requests to User-Supplied URLs
The SEO audit script accepts a URL, fetches that page, and derives robots.txt and sitemap URLs from the same host. This is intended SEO behavior, but it can disclose target URLs and may reach internal hosts if run in a privileged environment.
The code directly opens user-provided or derived URLs with urllib. The behavior matches the skill purpose, so the risk is contextual rather than malicious.
Medium
scripts/credential.py:8-11scripts/dataforseo_api.py:12-27scripts/dataforseo_api.py:31-39scripts/keyword_research.py:18-25scripts/backlinks.py:16-23
Third-Party API Calls Use Environment Credentials
DataForSEO scripts read DATAFORSEO_LOGIN and DATAFORSEO_PASSWORD, create a Basic Authorization header, and send keyword, domain, SERP, and backlink requests to api.dataforseo.com. This is documented functionality, but users must understand that credentials and query data leave the local environment.
Environment credential access and outbound POST requests are clear in the helper module. The destination is a relevant SEO provider, which lowers malicious-intent confidence.
Low
references/schema-templates.md:51-53
Unsafe Pipe-to-Shell Example in Documentation
A schema template includes an example answer telling users to run a curl command piped into bash. It is inside documentation and does not execute by itself, but it can encourage unsafe installation instructions in generated content.
The exact pipe-to-shell pattern appears in a markdown JSON-LD example. Context confirms it is documentation, not active code execution.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
Low
SKILL.md:40-50examples/opc-skills-case-study.md:66-74references/seo-checklist.md:19-24references/platform-algorithms.md:157-164
Static Command and Crypto Matches Are Mostly False Positives
Many external command detections are fenced markdown examples for curl, open, JSON, or HTML snippets. Many weak-crypto detections appear to match ordinary SEO text such as description, HTTPS, schema properties, or example metadata, with no cryptographic implementation found.
Targeted review showed documentation examples rather than executable Ruby backticks or crypto code. This confidence is high for reviewed samples, but not every reported line was manually inspected.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable