@seoagent-official/seoagent@1.108.4
The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe source shows first-party project setup that modifies Claude Code’s hook configuration, which warrants a warning under the agent integration policy. The manifest provides a CLI entrypoint, and the inspected setup is not an npm lifecycle mutation; no concrete malicious behavior was established.
Decision evidence
public snapshot- The package exposes a `seoagent` CLI entrypoint; no npm lifecycle hook is declared in the inspected manifest.
- The CLI’s explicit `init` command initializes a project and installs its skill file.
- Project setup writes a PostToolUse and SessionStart hook configuration into `.claude/settings.json`; the hook runs `seoagent sync --silent` or falls back to `npx`.
- The agent configuration change is tied to the explicit project initialization flow, rather than an npm install hook.
- The inspected shell use checks whether Claude is installed; no command-output exfiltration was established from the reviewed excerpts.
Source & flagged code
6 flaggedA single source file combines environment access, network access, and code or shell execution with blocking evidence.
index.jsView on unpkg · L87A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
Affected versions and remediation
This report applies to @seoagent-official/seoagent@1.108.4.
See all versions of @seoagent-official/seoagent for other recorded verdicts.
- Review the evidence and your use of @seoagent-official/seoagent@1.108.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.