@seoagent-official/seoagent@1.100.2
The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe default service endpoint is package-aligned, and the credential transfer requires a user-selected API base override plus an authenticated command. Because the override can direct saved credentials to an unrestricted host, this warrants a warning for conditional credential exposure, not a publish block.
Decision evidence
public snapshot- The manifest exposes index.js as the seoagent CLI binary.
- The default API host is https://seoagent.com, but SEOAGENT_API_BASE can override it.
- The autopilot command accepts a custom API base; its authenticated request sends the saved user and website tokens as a bearer credential to that base.
- The .claude/settings.json integration adds SessionStart and PostToolUse hooks that run a sync command and writes the settings file.
- The token transfer requires an authenticated autopilot command and a caller-selected API base override described as being for testing.
- The default recipient is the package-aligned service, and the manifest has no install lifecycle hook.
Source & flagged code
7 flaggedA single source file combines environment access, network access, and code or shell execution with blocking evidence.
index.jsView on unpkg · L85A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L85Findings
Affected versions and remediation
This report applies to @seoagent-official/seoagent@1.100.2.
See all versions of @seoagent-official/seoagent for other recorded verdicts.
- Review the evidence and your use of @seoagent-official/seoagent@1.100.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.