@seoagent-official/seoagent@1.101.4
The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe CLI forwards saved credentials to an operator-configurable API base without a host restriction, so an untrusted configured endpoint could receive them. The behavior is user-configured and user-invoked, supporting a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs an authenticated sync operation.
Impact
If the configured API base is untrusted, the credentials may be exposed to that endpoint. No attack was identified for the package's default package-aligned service.
Mechanism
The API base can be set through `SEOAGENT_API_BASE` or the login `--api-base` option, and sync attaches the saved authorization header to its request.
AI rationale
The CLI forwards saved credentials to an operator-configurable API base without a host restriction, so an untrusted configured endpoint could receive them. The behavior is user-configured and user-invoked, supporting a warning rather than a publish block.
Evidence
index.js
Network endpoints1
seoagent.com
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `package.json` exposes `index.js` as a CLI; it has no npm lifecycle hook.
- `index.js` accepts `SEOAGENT_API_BASE` as the API base without restricting its host.
- The CLI accepts `--api-base` during login, and stores the selected base with the account credentials.
- Sync sends the saved authorization header to the selected API base. This creates conditional credential exposure when a user configures an untrusted endpoint.
Evidence against
- The credential-bearing requests occur in CLI operations such as sync, not during npm installation.
- The API base is explicitly configurable by the operator, and no hidden credential recipient or exfiltration trigger was identified.
Behavioral surface
ChildProcessEnvironmentVarsNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedindex.jsView file
85- Bundle scaffolded.
L86: `,"utf-8"),r.push("log.md")),{created:r,okfDir:n}}import{log as Ot}from"@clack/prompts";var u={info:e=>Ot.info(e),warn:e=>Ot.warn(e),error:e=>Ot.error(e),success:e=>Ot.success(e),s...
L87: `))}function hg(){return`The setup code did not bind this project. Do not continue without a successful login \u2014 get a fresh code at seoagent.com/grok, then run \`${m("login")}...
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
index.jsView on unpkg · L8585Trigger-reachable chain: manifest.main -> index.js
L85: - Bundle scaffolded.
L86: `,"utf-8"),r.push("log.md")),{created:r,okfDir:n}}import{log as Ot}from"@clack/prompts";var u={info:e=>Ot.info(e),warn:e=>Ot.warn(e),error:e=>Ot.error(e),success:e=>Ot.success(e),s...
L87: `))}function hg(){return`The setup code did not bind this project. Do not continue without a successful login \u2014 get a fresh code at seoagent.com/grok, then run \`${m("login")}...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L8585- Bundle scaffolded.
L86: `,"utf-8"),r.push("log.md")),{created:r,okfDir:n}}import{log as Ot}from"@clack/prompts";var u={info:e=>Ot.info(e),warn:e=>Ot.warn(e),error:e=>Ot.error(e),success:e=>Ot.success(e),s...
L87: `))}function hg(){return`The setup code did not bind this project. Do not continue without a successful login \u2014 get a fresh code at seoagent.com/grok, then run \`${m("login")}...
Findings
2 Critical4 High4 Medium2 Low
CriticalSame File Env Network Executionindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processindex.js
HighShell
HighCommand Output Exfiltrationindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @seoagent-official/seoagent@1.101.4.
See all versions of @seoagent-official/seoagent for other recorded verdicts.
- Review the evidence and your use of @seoagent-official/seoagent@1.101.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.