registry / @seoagent-official/seoagent / 1.74.0

@seoagent-official/seoagent@1.74.0

⚠ Under review

The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 223 KB of source, external domains: 127.0.0.1, api.openai.com, api.replicate.com, console.anthropic.com, example.com, fal.run, registry.npmjs.org, seoagent.com, www.google.com

Source & flagged code

5 flagged

index.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

2import{Command as ng}from"commander";import{dirname as ii,relative as en}from"path";import{intro as gl,outro as hl,text as ni,select as Kn,spinner as yl,isCancel as Ge,cancel as We,confirm as wl}from"@clack/prompts";var Ie=[".env.local",".env.production",".env"],Vr=["NEXT_PUBLIC_SITE_URL","SITE_URL","NEXT_PUBLIC_URL","NEXTAUTH_URL","VITE_SITE_URL"];var se="@seoagent-official/seoagent",jt=`${se}@latest`;import{homedir as Ca}from"os";import{join as Oe}from"path";var k=".seoagent",zr=["audit","strategy/clusters","briefs","content","content/images","performance"],ke={AGENTS:".agents/skills/seoagen ...

3.legacy/

4content/images/*

5!content/images/.gitkeep

6.pull-receipt.json

7.ack-queue.json

8.sync.lock

9`,Ra=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.trim().length>0?process.env.XDG_CONFIG_HOME:Oe(Ca(),".config"),W=Oe(Ra,"seoagent"),de=Oe(W,"auth.json"),Rn=Oe(W,"state"),Ft=Oe(W,"update-check.json"),Ut=Oe(W,"projects.json");var ot="https://seoagent.com",Te=process.env.SEOAGENT_API_BASE&&process.env.SEOAGENT_API_BASE.trim().length>0?process.env.SEOAGENT_API_BASE.replace(/\/$/,""):ot,T={BASE:Te,PRICING:`${Te}/pricing`,LEAD_API:`${Te}/api/cli/lead`,CLI_AUTH_PAGE:`${Te}/cli/auth`,CLI_AUTH_POLL:`${Te}/api/cli/auth/poll`,CLI_SYNC:`${Te}/api/cli/sync`};function ee(e,t){let n=t&&t!=="unkn ...

10`),i=Da(r),s=i.length>0?i[0].indent:0,[a]=Zr(i,0,s);return{data:a,body:o}}function Bt(e){if(!La(e))return null;try{return pe(ja(e,"utf-8"))}catch{return null}}function Fa(e){if(e===null)return"null";if(typeof e=="boolean")return e?"true":"false";if(typeof e=="number")return String(e);let t=String(e);return t===""||/[:#\[\]{}&*!|>'"%@`,]/.test(t)||/^\s|\s$/.test(t)?`"${t.replace(/"/g,'\\"')}"`:t}function eo(e,t,n){let r=" ".repeat(t);for(let[o,i]of Object.entries(e))i!==void 0&&(i!==null&&typeof i=="object"?(n.push(`${r}${o}:`),eo(i,t+1,n)):n.push(`${r}${o}: ${Fa(i)}`))}function An(e,t=""){let ...

11`)?t:`

12${t}`;return n.join(`

13`)+r+(r.endsWith(`

14`)?"":`

15`)}var Ba=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function In(){return Ua()}var Ga=new Set(["strapi","wordpress","sanity","contentful","ghost","webflow","shopify","payload","directus","mdx-local","none"]),Wa="project.md";function it(e){return Pn(e,k)}function Gt(e){return Pn(it(e),Wa)}function oo(e){return to(Gt(e))}function E(e){let t=Bt(Gt(e));if(!t)return null;let n=t.data;if(typeof n.domain!="string"||!n.domain)return null;let r=typeof n.image_provider=="string"?n.image_provider:void 0,o=typeof n.cms=="string"?n.cms:void 0,i=o&&Ga.has(o)?o:void 0,s=typeof n.instal ...

16`)}function Ka(e){let t={domain:e.domain,site_type:e.site_type,language:e.language,initialized_at:e.initialized_at,seoagent_version:e.seoagent_version};return e.skill_version&&(t.skill_version=e.skill_version),e.install_id&&(t.install_id=e.install_id),e.image_provider&&(t.image_provider=e.image_provider),e.cms&&(t.cms=e.cms),e.blog_path&&(t.blog_path=e.blog_path),e.live_url&&(t.live_url=e.live_url),t}function io(e,t){let n=it(e);no(n,{recursive:!0});let r=An(Ka(t),Ha(t));ro(Gt(e),r,"utf-8")}function q(e,t){let n=Gt(e);if(!to(n))return!1;let r=pe(Ma(n,"utf-8")),o={...r.data,...t};return ro(n,An ...

17`,"utf-8");try{Ya(de,384)}catch{}}function uo(){if(!co(de))return!1;try{return Ja(de),!0}catch{return!1}}var Qa=new Set([502,503,504]),Za=1e4;async function P(e,t,n={}){let r=Math.max(1,n.attempts??3),o=Math.max(0,n.baseDelayMs??500),i=n.timeoutMs??Za,s=n.fetchImpl??fetch,a=n.sleep??ec,c=n.transientStatuses??Qa,u=null;for(let d=0;d<r;d++){let{init:p,cleanup:m}=tc(t,i);try{let g=await s(e,p);if(c.has(g.status)&&d<r-1){await a(po(o,d));continue}return g}catch(g){if(u=g,d<r-1){await a(po(o,d));continue}}finally{m()}}throw u instanceof Error?u:new Error(String(u))}function po(e,t){return e*Math.po ...

18`,"utf-8"),{file:t,added:o||s}}function xo(e){let t=De(e,Nt);if(!zt(t))return!1;let n=Nn(t).hooks;return n?So.some(r=>{let o=n[r];return Array.isArray(o)&&o.some(i=>i.hooks?.some(Dn))}):!1}function _o(e){let t=De(e,Nt);if(!zt(t))return{file:t,removed:!1};let n=Nn(t),r=n.hooks;if(!r)return{file:t,removed:!1};let o=!1;for(let i of So){let s=r[i];if(!Array.isArray(s))continue;for(let c of s){let u=c.hooks.length;c.hooks=c.hooks.filter(d=>!Dn(d)),c.hooks.length!==u&&(o=!0)}let a=s.filter(c=>c.hooks.length>0);a.length===0?delete r[i]:r[i]=a}return o?(Object.keys(r).length===0&&delete n.hooks,Vt(t,J ...

19`,"utf-8"),{file:t,removed:!0}):{file:t,removed:!1}}import{existsSync as Co,mkdirSync as hc,readFileSync as yc,writeFileSync as wc}from"fs";import{join as bc}from"path";function Ro(e){return Co(bc(e,k,"project.md"))}function Eo(){try{if(!Co(Ut))return[];let e=JSON.parse(yc(Ut,"utf-8"));return Array.isArray(e.projects)?e.projects.filter(t=>typeof t=="string"&&t.length>0):[]}catch{return[]}}function Ao(e){try{hc(W,{recursive:!0}),wc(Ut,JSON.stringify({projects:e},null,2)+`

20`,"utf-8")}catch{}}function $e(e){try{if(!Ro(e))return;let t=Eo();if(t.includes(e))return;t.push(e),Ao(t)}catch{}}function Po(){let e=Eo(),t=e.filter(Ro);return t.length!==e.length&&Ao(t),t}import{readFileSync as Sc,writeFileSync as xc,existsSync as _c}from"fs";import{join as Lo}from"path";function Oo(e){let t={business:{},writingInstructions:[],referenceUrls:[],topicsToAvoid:[],contentTone:null,additionalNotes:null},n=kc(e);for(let[r,o]of n){let i=r.toLowerCase().trim();i==="business context"?t.business=vc(o):i==="writing instructions"?t.writingInstructions=Io(o):i==="reference urls"?t.refere ...

21`)}function kc(e){let t=e.split(`

22`),n=[],r="",o=[];for(let i of t){let s=i.match(/^#\s+(.+)$/);s?(r&&n.push([r,o.join(`

23`)]),r=s[1],o=[]):o.push(i)}return r&&n.push([r,o.join(`

24`)]),n}function vc(e){let t={},n=e.split(`

25`);for(let r of n){let o=r.match(/^[-*]\s+\*\*(.+?):\*\*\s*(.*)$/);if(o){let i=o[1].toLowerCase().trim(),s=o[2].trim();s&&(t[i]=s)}}return t}function Io(e){let t=[],n=e.split(`

26`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function $c(e){let t=[],n=e.split(`

27`);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var jo="context.md";function Yt(e){let t=Lo(e,".seoagent",jo);if(!_c(t))return null;let n=Sc(t,"utf-8");return Oo(n)}function Cc(e,t){let n=Lo(e,".seoagent",jo),r=To(t);xc(n,r,"utf-8")}function No(e,t){Cc(e,{business:{type:t||""},writingInstructions:[],referenceUrls:[],topicsToAvoid:[],contentTone:null,additionalNotes:null})}import{existsSync as at,readFileSync as Do,readdirSync as Rc,statSync as Fo}from"fs";import{join as Se}from"path";var Ec=[{c ...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

28`),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching rows you or the audit have edited. `In sitemap` is refreshed from","the live sitemap; `Status` / `Rendered` / `Word count` are filled by","`seoagent refresh --crawl` (a live fetch of each page). This file syncs to","the cloud on login."].join(`

29`),r="| URL | In sitemap | In nav | Status | Rendered | Word count | Notes |",o="|---|---|---|---|---|---|---|",i=e.map(s=>`| ${s.url} | ${s.in_sitemap} | ${s.in_nav} | ${s.status} | ${s.rendered} | ${s.word_count} | ${s.notes} |`);return[t,"",n,"",r,o,...i,""].join(`

30`)}function fl(e){let t=new Map,n;try{n=ul(e,"utf-8")}catch{return t}let r=n.split(/\r?\n/);for(let o=0;o<r.length-1;o++){if(!Hn(r[o])||!ml(r[o+1]))continue;let i=ei(r[o]).map(a=>a.toLowerCase()),s={url:i.findIndex(a=>a.includes("url")),in_sitemap:i.findIndex(a=>a.includes("sitemap")),in_nav:i.findIndex(a=>a.includes("nav")),status:i.findIndex(a=>a.includes("status")||a.includes("http")),rendered:i.findIndex(a=>a.includes("render")),word_count:i.findIndex(a=>a.includes("word")),notes:i.findIndex(a=>a.includes("note"))};if(s.url===-1)return t;for(let a=o+2;a<r.length&&Hn(r[a]);a++){let c=ei(r[a ...

31`))}import{existsSync as ci}from"fs";import{intro as $l,outro as Sl,confirm as xl,isCancel as _l,cancel as Cl}from"@clack/prompts";import{existsSync as tn,rmSync as vl}from"fs";import{join as nn}from"path";function si(

32`);if(!r){$l("SEOAgent \u2014 uninstall"),l.message(`This will remove:

33${o}`);let s=await xl({message:"Remove these and start fresh?"});if(_l(s)||!s){Cl("Cancelled \u2014 nothing was removed.");return}}ai(t,n);let i=n.map(s=>` \u2713 ${s.label}`).join(`

34`);r?l.success(`Removed:

35${i}`):Sl(`Removed:

36${i}`),!e.global&&ci(W)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-install any time with \`${f("init")}\`.`)}import C from"picocolors";import{existsSync as pt,readdirSync as qn,statSync as Rl,readFileSync as li}from"fs";import{join as He}from

37`)}function Nl(e,t){if(!t)return me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=di(t),r=e-5-n;return r<1?me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${me.dim("\u250C\u2500 ")}${t}${me.dim(` ${"\u2500".repeat(r)}\u2510`)}`}function Dl(e,t){let n=di(e),r;return n<=t?r=e+" ".repeat(t-n):r=e,`${me.dim("\u2502")} ${r} ${me.dim("\u2502")}`}function Vn(e){let t=Date.now()-new Date(e).getTime(),n=Math.floor(t/6e4);if(n<60)return`${n} minutes ago`;let r=Math.floor(n/60);return r<24?`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L26

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L26

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L26

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

39Live: ${e.canonical}`:"",o=[`# ${e.title}`,"",`Tracked record \u2014 this article is **${e.status}** and ${n}.`,"This is a pointer so the cloud dashboard can track it without duplicating","the body. Edit the source file to change the article."+r,""].join(`

40`);return`${t.join(`

41`)}

43${o}

44`}function wi(e,t){let n=qe(e,k,"content"),r=Yn(n),o=new Set;for(let c of r)c.source==="repo"&&c.repo_path&&o.add(fu(c.repo_path));if(o.size===0)return{tracked:[]};let i=[...o].

45action_id: ${e.id}

46action_type: ${e.action_type}

47article_id: ${n}

48slug: ${r??""}

49cms_type: ${s??""}

50created_at: ${e.created_at}

51---

53# Prune action \u2014 ${o??`article ${n}`}

55SEOAgent's auto-prune determined that this article should be removed from

56your repo. The cloud has already marked it pruned in your dashboard and

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

index.jsView file

26`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function $c(e){let t=[],n=e.split(` L27: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var jo="context.md";function Yt... L28: `),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching r... ... L36: ${i}`),!e.global&&ci(W)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-i... L37: `)}function Nl(e,t){if(!t)return me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=di(t),r=e-5-n;return r<1?me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${me.dim("\u250C\u2500 ... L38:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L26

26Trigger-reachable chain: manifest.main -> index.js L26: `);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function $c(e){let t=[],n=e.split(` L27: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var jo="context.md";function Yt... L28: `),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching r... ... L36: ${i}`),!e.global&&ci(W)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-i... L37: `)}function Nl(e,t){if(!t)return me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=di(t),r=e-5-n;return r<1?me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${me.dim("\u250C\u2500 ... L38:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L26

36${i}`),!e.global&&ci(W)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-i... L37: `)}function Nl(e,t){if(!t)return me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=di(t),r=e-5-n;return r<1?me.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${me.dim("\u250C\u2500 ... L38:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L26

8.sync.lock L9: `,Ra=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.trim().length>0?process.env.XDG_CONFIG_HOME:Oe(Ca(),".config"),W=Oe(Ra,"seoagent"),de=Oe(W,"auth.json"),Rn=Oe(W,"state... L10: `),i=Da(r),s=i.length>0?i[0].indent:0,[a]=Zr(i,0,s);return{data:a,body:o}}function Bt(e){if(!La(e))return null;try{return pe(ja(e,"utf-8"))}catch{return null}}function Fa(e){if(e==... ... L15: `)}var Ba=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function In(){return Ua()}var Ga=new Set(["strapi","wordpress","sanity","contentful","ghost","webflow","... L16: `)}function Ka(e){let t={domain:e.domain,site_type:e.site_type,language:e.language,initialized_at:e.initialized_at,seoagent_version:e.seoagent_version};return e.skill_version&&(t.s... L17: `,"utf-8");try{Ya(de,384)}catch{}}function uo(){if(!co(de))return!1;try{return Ja(de),!0}catch{return!1}}var Qa=new Set([502,503,504]),Za=1e4;async function P(e,t,n={}){let r=Math.... ... L26: `);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function $c(e){let t=[],n=e.split(` L27: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

Findings

2 Critical3 High3 Medium2 Low

CriticalSame File Env Network Executionindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js

HighCommand Output Exfiltrationindex.js

HighSandbox Evasion Gated Capabilityindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

index.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

3.legacy/

4content/images/*

5!content/images/.gitkeep

6.pull-receipt.json

7.ack-queue.json

8.sync.lock

11`)?t:`

12${t}`;return n.join(`

13`)+r+(r.endsWith(`

14`)?"":`

21`)}function kc(e){let t=e.split(`

22`),n=[],r="",o=[];for(let i of t){let s=i.match(/^#\s+(.+)$/);s?(r&&n.push([r,o.join(`

23`)]),r=s[1],o=[]):o.push(i)}return r&&n.push([r,o.join(`

24`)]),n}function vc(e){let t={},n=e.split(`

25`);for(let r of n){let o=r.match(/^[-*]\s+\*\*(.+?):\*\*\s*(.*)$/);if(o){let i=o[1].toLowerCase().trim(),s=o[2].trim();s&&(t[i]=s)}}return t}function Io(e){let t=[],n=e.split(`

26`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function $c(e){let t=[],n=e.split(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

32`);if(!r){$l("SEOAgent \u2014 uninstall"),l.message(`This will remove:

33${o}`);let s=await xl({message:"Remove these and start fresh?"});if(_l(s)||!s){Cl("Cancelled \u2014 nothing was removed.");return}}ai(t,n);let i=n.map(s=>` \u2713 ${s.label}`).join(`

34`);r?l.success(`Removed:

35${i}`):Sl(`Removed:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L26

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L26

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L26

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

40`);return`${t.join(`

41`)}

43${o}

44`}function wi(e,t){let n=qe(e,k,"content"),r=Yn(n),o=new Set;for(let c of r)c.source==="repo"&&c.repo_path&&o.add(fu(c.repo_path));if(o.size===0)return{tracked:[]};let i=[...o].

45action_id: ${e.id}

46action_type: ${e.action_type}

47article_id: ${n}

48slug: ${r??""}

49cms_type: ${s??""}

50created_at: ${e.created_at}

51---

53# Prune action \u2014 ${o??`article ${n}`}

55SEOAgent's auto-prune determined that this article should be removed from

56your repo. The cloud has already marked it pruned in your dashboard and

Long lines were clipped for display.