@seoagent-official/seoagent@1.104.0
The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.
AI Security Review
scanned 28d ago · by lpm-firewall-aiSource inspection confirms a user-invoked Claude integration that installs package-owned sync hooks, which merits a warning under the agent capability policy. No npm install trigger or concrete malicious exfiltration chain was established.
Decision evidence
public snapshot- package.json exposes a CLI entrypoint and has no registry install lifecycle hook.
- index.js targets the package-owned skill directory and Claude settings file.
- index.js defines SessionStart and PostToolUse hooks that run this package's sync command.
- The agent integration is exposed through the explicit `init` CLI command.
- No inspected source shows the flagged command-output exfiltration behavior; the shell calls inspected check for Claude or launch its login/install commands.
- The settings integration belongs to SEOAgent and is installed by `init`, not by npm installation.
Source & flagged code
6 flaggedA single source file combines environment access, network access, and code or shell execution with blocking evidence.
index.jsView on unpkg · L87A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
Affected versions and remediation
This report applies to @seoagent-official/seoagent@1.104.0.
See all versions of @seoagent-official/seoagent for other recorded verdicts.
- Review the evidence and your use of @seoagent-official/seoagent@1.104.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.