📦

Audit History

technical-seo-checker - 4 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v4 Latest2026年7月12日 下午02:13 No confirmed findings5No capability change
v3 2026年7月12日 下午02:13 No confirmed findings5No capability change
v2 2026年7月7日 下午05:37 No confirmed findings0No capability change
v1 2026年7月4日 下午04:27 No confirmed findings0Baseline

2026年7月12日 下午02:13

Most static findings are Markdown fences, relative documentation links, placeholders, or SEO checklist text. Five findings are confirmed: four executable command recipes and one outbound-network use at SKILL.md lines 98-104; no prompt injection or malicious intent was found.

9
Files scanned
980
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell backtick execution
**Zero-dependency local helpers** (no tool needed, run yourself): `python3 "${CLAUDE_PLUGIN_ROOT}/sc
Line 98 explicitly tells the agent to run local Python helpers with a user-supplied URL and includes a shell pipeline. This is legitimate SEO tooling, but command execution and unvalidated input create real execution risk.
Medium
Ruby/shell backtick execution
**JS-rendering fallback (keyless)**: when `crawl.py`/`onpage.py` return an empty or thin body on a c
Line 100 directs the agent to execute a Firecrawl helper against a supplied URL and permits an own-site bypass. The command is relevant, but it performs active network retrieval through executable code.
Medium
Ruby/shell backtick execution
**Keyless recipe sharpeners**: subdomain inventory from certificate-transparency logs — `curl "https
Line 102 provides an executable curl recipe that interpolates a supplied domain and sends a request to crt.sh. Shell interpolation and outbound execution are genuine risks even though the audit purpose is legitimate.
Medium
Ruby/shell backtick execution
**Index-push after fixes (write channel, gated)**: once crawl/indexing fixes ship, `python3 "${CLAUD
Line 104 directs execution of an index-push helper that can submit URLs to external search services when --live is used. The dry-run gate reduces risk, but the command has an intentional external side effect.
Low
Hardcoded URL
**Keyless recipe sharpeners**: subdomain inventory from certificate-transparency logs — `curl "https
Line 102 intentionally sends audit queries to crt.sh and identifies the W3C validator as another external endpoint. These are relevant public services, but they disclose the queried domain or URL to third parties.
Audited by: codex

2026年7月12日 下午02:13

大多數靜態發現都是 Markdown 圍欄、相對文件連結、預留位置或 SEO 檢查清單文字。已確認五項發現:四項可執行的命令操作方式,以及一項位於 SKILL.md 第 98-104 行的對外網路使用;未發現提示詞注入或惡意意圖。

9
Files scanned
980
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (5)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
Ruby/shell 反引號執行
**Zero-dependency local helpers** (no tool needed, run yourself): `python3 "${CLAUDE_PLUGIN_ROOT}/sc
第 98 行明確指示代理程式使用使用者提供的 URL 執行本機 Python 輔助工具,並包含 shell 管線。這是合法的 SEO 工具,但命令執行和未驗證的輸入會造成實際的執行風險。
Medium
Ruby/shell 反引號執行
**JS-rendering fallback (keyless)**: when `crawl.py`/`onpage.py` return an empty or thin body on a c
第 100 行指示代理程式對提供的 URL 執行 Firecrawl 輔助工具,並允許對自有網站略過限制。此命令具有相關用途,但會透過可執行程式碼進行主動網路擷取。
Medium
Ruby/shell 反引號執行
**Keyless recipe sharpeners**: subdomain inventory from certificate-transparency logs — `curl "https
第 102 行提供一項可執行的 curl 操作方式,會插入所提供的網域並向 crt.sh 傳送請求。儘管稽核目的合法,shell 插值和對外執行仍會造成實際風險。
Medium
Ruby/shell 反引號執行
**Index-push after fixes (write channel, gated)**: once crawl/indexing fixes ship, `python3 "${CLAUD
第 104 行指示執行索引推送輔助工具,使用 --live 時可將 URL 提交至外部搜尋服務。試執行閘門可降低風險,但該命令具有刻意設計的外部副作用。
Low
硬編碼 URL
**Keyless recipe sharpeners**: subdomain inventory from certificate-transparency logs — `curl "https
第 102 行刻意將稽核查詢傳送至 crt.sh,並將 W3C 驗證器識別為另一個外部端點。這些是相關的公共服務,但會向第三方洩露所查詢的網域或 URL。
Audited by: codex

2026年7月4日 下午04:27

All 61 static findings are false positives caused by Markdown code fences, inline code, example URLs, relative documentation links, and SEO terminology. No evidence found of prompt injection, credential exfiltration, hidden executable code, or malicious network behavior in the reviewed files. The skill mentions optional audit helpers and write-channel index submission, but they are documented, user-directed, and gated by dry-run or live flags.

9
Files scanned
978
Lines analyzed
3
Review items
0
False positives ignored
Audited by: codex