@seoagent-official/seoagent@1.101.1
The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.
AI Security Review
scanned 28d ago · by lpm-firewall-aiSource inspection found package-owned Claude Code hooks that automatically invoke sync after setup or skill refresh. With no npm lifecycle trigger or additional concrete attack behavior established, this is a warning-level agent extension lifecycle risk.
Decision evidence
public snapshot- The package exposes a CLI and describes SEO audit and content workflows.
- The entrypoint defines a Claude settings hook that runs SEOAgent sync at session start and after Write/Edit tool use.
- The skill refresh path calls the hook setup function, so refresh can establish the automatic sync hooks.
- A Claude credential check reads and validates local credential state; this inspected code does not transmit credential contents.
- The manifest has no install lifecycle scripts, so npm installation does not itself add the hooks.
- The inspected command execution checks Claude availability or login state; no command output is sent in the cited code.
Source & flagged code
6 flaggedA single source file combines environment access, network access, and code or shell execution with blocking evidence.
index.jsView on unpkg · L85A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L85Findings
Affected versions and remediation
This report applies to @seoagent-official/seoagent@1.101.1.
See all versions of @seoagent-official/seoagent for other recorded verdicts.
- Review the evidence and your use of @seoagent-official/seoagent@1.101.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.