registry / @seoagent-official/seoagent / 1.70.0

@seoagent-official/seoagent@1.70.0

⚠ Under review

The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 202 KB of source, external domains: api.openai.com, api.replicate.com, console.anthropic.com, example.com, fal.run, registry.npmjs.org, seoagent.com, www.google.com

Source & flagged code

5 flagged

index.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

2import{Command as Ff}from"commander";import{dirname as Lo,relative as Wt}from"path";import{intro as vc,outro as xc,text as Io,select as In,spinner as _c,isCancel as De,cancel as Fe,confirm as Cc}from"@clack/prompts";var Ae=[".env.local",".env.production",".env"],Er=["NEXT_PUBLIC_SITE_URL","SITE_URL","NEXT_PUBLIC_URL","NEXTAUTH_URL","VITE_SITE_URL"];var re="@seoagent-official/seoagent",_t=`${re}@latest`;import{homedir as Ms}from"os";import{join as Pe}from"path";var k=".seoagent",Rr=["audit","strategy/clusters","briefs","content","content/images","performance"],he={AGENTS:".agents/skills/seoagen ...

3.legacy/

4content/images/*

5!content/images/.gitkeep

6.pull-receipt.json

7.ack-queue.json

8.sync.lock

9`,Bs=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.trim().length>0?process.env.XDG_CONFIG_HOME:Pe(Ms(),".config"),G=Pe(Bs,"seoagent"),ae=Pe(G,"auth.json"),fn=Pe(G,"state"),Rt=Pe(G,"update-check.json"),At=Pe(G,"projects.json");var ze="https://seoagent.com",Ie=process.env.SEOAGENT_API_BASE&&process.env.SEOAGENT_API_BASE.trim().length>0?process.env.SEOAGENT_API_BASE.replace(/\/$/,""):ze,R={BASE:Ie,PRICING:`${Ie}/pricing`,LEAD_API:`${Ie}/api/cli/lead`,CLI_AUTH_PAGE:`${Ie}/cli/auth`,CLI_AUTH_POLL:`${Ie}/api/cli/auth/poll`,CLI_SYNC:`${Ie}/api/cli/sync`};import{readFileSync as Gs}from"fs"; ...

10`),i=Qs(r),s=i.length>0?i[0].indent:0,[a]=Or(i,0,s);return{data:a,body:o}}function It(e){if(!zs(e))return null;try{return ce(Vs(e,"utf-8"))}catch{return null}}function Xs(e){if(e===null)return"null";if(typeof e=="boolean")return e?"true":"false";if(typeof e=="number")return String(e);let t=String(e);return t===""||/[:#\[\]{}&*!|>'"%@`,]/.test(t)||/^\s|\s$/.test(t)?`"${t.replace(/"/g,'\\"')}"`:t}function Lr(e,t,n){let r=" ".repeat(t);for(let[o,i]of Object.entries(e))i!==void 0&&(i!==null&&typeof i=="object"?(n.push(`${r}${o}:`),Lr(i,t+1,n)):n.push(`${r}${o}: ${Xs(i)}`))}function gn(e,t=""){let ...

11`)?t:`

12${t}`;return n.join(`

13`)+r+(r.endsWith(`

14`)?"":`

15`)}var ta=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function yn(){return Zs()}var na=new Set(["strapi","wordpress","sanity","contentful","ghost","webflow","shopify","payload","directus","mdx-local","none"]),ra="project.md";function Ve(e){return hn(e,k)}function Tt(e){return hn(Ve(e),ra)}function Fr(e){return jr(Tt(e))}function C(e){let t=It(Tt(e));if(!t)return null;let n=t.data;if(typeof n.domain!="string"||!n.domain)return null;let r=typeof n.image_provider=="string"?n.image_provider:void 0,o=typeof n.cms=="string"?n.cms:void 0,i=o&&na.has(o)?o:void 0,s=typeof n.instal ...

16`)}function ia(e){let t={domain:e.domain,site_type:e.site_type,language:e.language,initialized_at:e.initialized_at,seoagent_version:e.seoagent_version};return e.skill_version&&(t.skill_version=e.skill_version),e.install_id&&(t.install_id=e.install_id),e.image_provider&&(t.image_provider=e.image_provider),e.cms&&(t.cms=e.cms),e.blog_path&&(t.blog_path=e.blog_path),t}function Ur(e,t){let n=Ve(e);Nr(n,{recursive:!0});let r=gn(ia(t),oa(t));Dr(Tt(e),r,"utf-8")}function V(e,t){let n=Tt(e);if(!jr(n))return!1;let r=ce(ea(n,"utf-8")),o={...r.data,...t};return Dr(n,gn(o,r.body),"utf-8"),!0}function Mr(e ...

17`,"utf-8"),{file:t,added:o||s}}function Xr(e){let t=Oe(e,Ct);if(!Dt(t))return!1;let n=Sn(t).hooks;return n?Qr.some(r=>{let o=n[r];return Array.isArray(o)&&o.some(i=>i.hooks?.some(vn))}):!1}function Zr(e){let t=Oe(e,Ct);if(!Dt(t))return{file:t,removed:!1};let n=Sn(t),r=n.hooks;if(!r)return{file:t,removed:!1};let o=!1;for(let i of Qr){let s=r[i];if(!Array.isArray(s))continue;for(let c of s){let u=c.hooks.length;c.hooks=c.hooks.filter(d=>!vn(d)),c.hooks.length!==u&&(o=!0)}let a=s.filter(c=>c.hooks.length>0);a.length===0?delete r[i]:r[i]=a}return o?(Object.keys(r).length===0&&delete n.hooks,Nt(t,J ...

18`,"utf-8"),{file:t,removed:!0}):{file:t,removed:!1}}import{existsSync as eo,mkdirSync as xa,readFileSync as _a,writeFileSync as Ca}from"fs";import{join as Ea}from"path";function to(e){return eo(Ea(e,k,"project.md"))}function no(){try{if(!eo(At))return[];let e=JSON.parse(_a(At,"utf-8"));return Array.isArray(e.projects)?e.projects.filter(t=>typeof t=="string"&&t.length>0):[]}catch{return[]}}function ro(e){try{xa(G,{recursive:!0}),Ca(At,JSON.stringify({projects:e},null,2)+`

19`,"utf-8")}catch{}}function we(e){try{if(!to(e))return;let t=no();if(t.includes(e))return;t.push(e),ro(t)}catch{}}function oo(){let e=no(),t=e.filter(to);return t.length!==e.length&&ro(t),t}import{readFileSync as Ia,writeFileSync as Ta,existsSync as Oa}from"fs";import{join as co}from"path";function so(e){let t={business:{},writingInstructions:[],referenceUrls:[],topicsToAvoid:[],contentTone:null,additionalNotes:null},n=Ra(e);for(let[r,o]of n){let i=r.toLowerCase().trim();i==="business context"?t.business=Aa(o):i==="writing instructions"?t.writingInstructions=io(o):i==="reference urls"?t.refere ...

20`)}function Ra(e){let t=e.split(`

21`),n=[],r="",o=[];for(let i of t){let s=i.match(/^#\s+(.+)$/);s?(r&&n.push([r,o.join(`

22`)]),r=s[1],o=[]):o.push(i)}return r&&n.push([r,o.join(`

23`)]),n}function Aa(e){let t={},n=e.split(`

24`);for(let r of n){let o=r.match(/^[-*]\s+\*\*(.+?):\*\*\s*(.*)$/);if(o){let i=o[1].toLowerCase().trim(),s=o[2].trim();s&&(t[i]=s)}}return t}function io(e){let t=[],n=e.split(`

25`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Pa(e){let t=[],n=e.split(`

26`);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var lo="context.md";function Ft(e){let t=co(e,".seoagent",lo);if(!Oa(t))return null;let n=Ia(t,"utf-8");return so(n)}function La(e,t){let n=co(e,".seoagent",lo),r=ao(t);Ta(n,r,"utf-8")}function uo(e,t){La(e,{business:{type:t||""},writingInstructions:[],referenceUrls:[],topicsToAvoid:[],contentTone:null,additionalNotes:null})}import{existsSync as Qe,readFileSync as po,readdirSync as ja,statSync as fo}from"fs";import{join as ke}from"path";var Na=[{c ...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

27`),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching rows you or the audit have edited. `In sitemap` is refreshed from","the live sitemap; `Status` / `Rendered` / `Word count` are filled by","`seoagent refresh --crawl` (a live fetch of each page). This file syncs to","the cloud on login."].join(`

28`),r="| URL | In sitemap | In nav | Status | Rendered | Word count | Notes |",o="|---|---|---|---|---|---|---|",i=e.map(s=>`| ${s.url} | ${s.in_sitemap} | ${s.in_nav} | ${s.status} | ${s.rendered} | ${s.word_count} | ${s.notes} |`);return[t,"",n,"",r,o,...i,""].join(`

29`)}function $c(e){let t=new Map,n;try{n=wc(e,"utf-8")}catch{return t}let r=n.split(/\r?\n/);for(let o=0;o<r.length-1;o++){if(

30`))}import{existsSync as Do}from"fs";import{intro as Pc,outro as Ic,confirm as Tc,isCancel as Oc,cancel as Lc}from"@clack/prompts";import{existsSync as Ht,rmSync as Ac}from"fs";import{join as Kt}from"path";function jo(e,t={}){let n=[],r=Kt(e,k);Ht(r)&&n.push({label:".seoagent/ \u2014 project state + all generated work",path:r,kind:"dir"});let o=Kt(e,he.CLAUDE);Ht(o)&&n.push({label:".claude/skills/seoagent/ \u2014 installed skill bundle",path:o,kind:"dir"});let i=Kt(e,he.AGENTS);return Ht(i)&&n.push({label:".agents/skills/seoagent/ \u2014 installed skill bundle",path:i,kind:"dir"}),Xr(e)&&n.pus ...

31`);if(!r){Pc("SEOAgent \u2014 uninstall"),l.message(`This will remove:

32${o}`);let s=await Tc({message:"Remove these and start fresh?"});if(Oc(s)||!s){Lc("Cancelled \u2014 nothing was removed.");return}}No(t,n);let i=n.map(s=>` \u2713 ${s.label}`).join(`

33`);r?l.success(`Removed:

34${i}`):Ic(`Removed:

35${i}`),!e.global&&Do(G)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-install any time with \`${f("init")}\`.`)}import x from"picocolors";import{existsSync as Uo,mkdirSync as Fo,readFileSync as jc,writeFileSync as

36`,"utf-8");try{Dc(ae,384)}catch{}}function Bo(){if(!Uo(ae))return!1;try{return Fc(ae),!0}catch{return!1}}import{existsSync as nt,readdirSync as On,statSync as Mc,readFileSync as Go}from"fs";import{join as Ue}from"path";function Bc(e){let t=(e.match(/^\s*-\s+\[\s\]/gm)??[]).length,n=(e.match(/^\s*-\s+\[x\]/gim)??[]).length;return{open:t,done:n}}function Gc(e){let t=Ue(e,"audit","latest.md");if(!nt(t))return null;let n=It(t);if(!n)return null;let r=Go(t,"utf-8"),o=Bc(r);return{exists:!0,date:typeof n.data.audited_at=="string"?n.data.audited_at:void 0,issueCount:o.open}}function Wc(e){try{let n=G ...

37`)}function Vc(e,t){if(!t)return ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ho(t),r=e-5-n;return r<1?ue.dim

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L25

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L25

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L25

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

39Live: ${e.canonical}`:"",o=[`# ${e.title}`,"",`Tracked record \u2014 this article is **${e.status}** and ${n}.`,"This is a pointer so the cloud dashboard can track it without duplicating","the body. Edit the source file to change the article."+r,""].join(`

40`);return`${t.join(`

41`)}

43${o}

44`}function Qo(e,t){let n=Be(e,k,"content"),r=Nn(n),o=new Set;for(let c of r)c.source==="repo"&&c.repo_path&&o.add(Cl(c.repo_path));if(o.size===0)return{tracked:[]};let i=[...o].flatMap(c=>jn(e,c)),s=Dn(i,r,Fn(e));if(s.toTrack.length===0)return{tracked:[]};xl(n,{recursive:!0});let a=[];for(let c of s.toTrack){let u=ut({slug:c.slug,title:c.title,canonical:lt(c.slug,{domain:t.domain,blogPath:t.blog_path}),status:"published",page_type:c.page_type,source:"repo",repo_path:c.path,tracked_at:new Date().toISOString()});_l(Be(n,`${c.slug}.md`),u,"utf-8"),a.push(c.slug)}return{tracked:a}}import{existsSyn ...

45action_id: ${e.id}

46action_type: ${e.action_type}

47article_id: ${n}

48slug: ${r??""}

49cms_type: ${s??""}

50created_at: ${e.created_at}

51---

53# Prune action \u2014 ${o??`article ${n}`}

55SEOAgent's auto-prune determined that this article should be removed from

56your repo. The cloud has already marked it pruned in your dashboard and

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

index.jsView file

25`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Pa(e){let t=[],n=e.split(` L26: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var lo="context.md";function Ft... L27: `),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching r... ... L36: `,"utf-8");try{Dc(ae,384)}catch{}}function Bo(){if(!Uo(ae))return!1;try{return Fc(ae),!0}catch{return!1}}import{existsSync as nt,readdirSync as On,statSync as Mc,readFileSync as Go... L37: `)}function Vc(e,t){if(!t)return ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ho(t),r=e-5-n;return r<1?ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${ue.dim("\u250C\u2500 ... L38:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L25

25Trigger-reachable chain: manifest.main -> index.js L25: `);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Pa(e){let t=[],n=e.split(` L26: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var lo="context.md";function Ft... L27: `),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching r... ... L36: `,"utf-8");try{Dc(ae,384)}catch{}}function Bo(){if(!Uo(ae))return!1;try{return Fc(ae),!0}catch{return!1}}import{existsSync as nt,readdirSync as On,statSync as Mc,readFileSync as Go... L37: `)}function Vc(e,t){if(!t)return ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ho(t),r=e-5-n;return r<1?ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${ue.dim("\u250C\u2500 ... L38:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L25

36`,"utf-8");try{Dc(ae,384)}catch{}}function Bo(){if(!Uo(ae))return!1;try{return Fc(ae),!0}catch{return!1}}import{existsSync as nt,readdirSync as On,statSync as Mc,readFileSync as Go... L37: `)}function Vc(e,t){if(!t)return ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ho(t),r=e-5-n;return r<1?ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${ue.dim("\u250C\u2500 ... L38:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L25

8.sync.lock L9: `,Bs=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.trim().length>0?process.env.XDG_CONFIG_HOME:Pe(Ms(),".config"),G=Pe(Bs,"seoagent"),ae=Pe(G,"auth.json"),fn=Pe(G,"state... L10: `),i=Qs(r),s=i.length>0?i[0].indent:0,[a]=Or(i,0,s);return{data:a,body:o}}function It(e){if(!zs(e))return null;try{return ce(Vs(e,"utf-8"))}catch{return null}}function Xs(e){if(e==... ... L15: `)}var ta=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function yn(){return Zs()}var na=new Set(["strapi","wordpress","sanity","contentful","ghost","webflow","... L16: `)}function ia(e){let t={domain:e.domain,site_type:e.site_type,language:e.language,initialized_at:e.initialized_at,seoagent_version:e.seoagent_version};return e.skill_version&&(t.s... L17: `,"utf-8"),{file:t,added:o||s}}function Xr(e){let t=Oe(e,Ct);if(!Dt(t))return!1;let n=Sn(t).hooks;return n?Qr.some(r=>{let o=n[r];return Array.isArray(o)&&o.some(i=>i.hooks?.some(v... ... L25: `);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Pa(e){let t=[],n=e.split(` L26: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

Findings

2 Critical3 High3 Medium2 Low

CriticalSame File Env Network Executionindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js

HighCommand Output Exfiltrationindex.js

HighSandbox Evasion Gated Capabilityindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

index.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

3.legacy/

4content/images/*

5!content/images/.gitkeep

6.pull-receipt.json

7.ack-queue.json

8.sync.lock

11`)?t:`

12${t}`;return n.join(`

13`)+r+(r.endsWith(`

14`)?"":`

20`)}function Ra(e){let t=e.split(`

21`),n=[],r="",o=[];for(let i of t){let s=i.match(/^#\s+(.+)$/);s?(r&&n.push([r,o.join(`

22`)]),r=s[1],o=[]):o.push(i)}return r&&n.push([r,o.join(`

23`)]),n}function Aa(e){let t={},n=e.split(`

24`);for(let r of n){let o=r.match(/^[-*]\s+\*\*(.+?):\*\*\s*(.*)$/);if(o){let i=o[1].toLowerCase().trim(),s=o[2].trim();s&&(t[i]=s)}}return t}function io(e){let t=[],n=e.split(`

25`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Pa(e){let t=[],n=e.split(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

29`)}function $c(e){let t=new Map,n;try{n=wc(e,"utf-8")}catch{return t}let r=n.split(/\r?\n/);for(let o=0;o<r.length-1;o++){if(

31`);if(!r){Pc("SEOAgent \u2014 uninstall"),l.message(`This will remove:

32${o}`);let s=await Tc({message:"Remove these and start fresh?"});if(Oc(s)||!s){Lc("Cancelled \u2014 nothing was removed.");return}}No(t,n);let i=n.map(s=>` \u2713 ${s.label}`).join(`

33`);r?l.success(`Removed:

34${i}`):Ic(`Removed:

37`)}function Vc(e,t){if(!t)return ue.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ho(t),r=e-5-n;return r<1?ue.dim

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L25

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L25

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L25

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

40`);return`${t.join(`

41`)}

43${o}

45action_id: ${e.id}

46action_type: ${e.action_type}

47article_id: ${n}

48slug: ${r??""}

49cms_type: ${s??""}

50created_at: ${e.created_at}

51---

53# Prune action \u2014 ${o??`article ${n}`}

55SEOAgent's auto-prune determined that this article should be removed from

56your repo. The cloud has already marked it pruned in your dashboard and

Long lines were clipped for display.