registry / @seoagent-official/seoagent / 1.77.1

@seoagent-official/seoagent@1.77.1

⚠ Under review

The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 245 KB of source, external domains: 127.0.0.1, api.openai.com, api.replicate.com, console.anthropic.com, example.com, fal.run, registry.npmjs.org, seoagent.com, www.google.com

Source & flagged code

5 flagged

index.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

2import{Command as Kg}from"commander";import{dirname as ki,relative as dn}from"path";import{intro as Ml,outro as Fl,text as wi,select as tr,spinner as Ul,isCancel as He,cancel as Ke,confirm as Bl}from"@clack/prompts";var Le=[".env.local",".env.production",".env"],co=["NEXT_PUBLIC_SITE_URL","SITE_URL","NEXT_PUBLIC_URL","NEXTAUTH_URL","VITE_SITE_URL"];var le="@seoagent-official/seoagent",Kt=`${le}@latest`;import{homedir as Ya}from"os";import{join as je}from"path";var b=".seoagent",lo=["audit","strategy/clusters","briefs","content","content/images","performance"],Se={AGENTS:".agents/skills/seoagen ...

3.legacy/

4content/images/*

5!content/images/.gitkeep

6.pull-receipt.json

7.ack-queue.json

8.sync.lock

9`,Ja=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.trim().length>0?process.env.XDG_CONFIG_HOME:je(Ya(),".config"),G=je(Ja,"seoagent"),me=je(G,"auth.json"),Mn=je(G,"state"),Vt=je(G,"update-check.json"),zt=je(G,"projects.json");var lt="https://seoagent.com",Ne=process.env.SEOAGENT_API_BASE&&process.env.SEOAGENT_API_BASE.trim().length>0?process.env.SEOAGENT_API_BASE.replace(/\/$/,""):lt,L={BASE:Ne,PRICING:`${Ne}/pricing`,LEAD_API:`${Ne}/api/cli/lead`,CLI_AUTH_PAGE:`${Ne}/cli/auth`,CLI_AUTH_POLL:`${Ne}/api/cli/auth/poll`,CLI_SYNC:`${Ne}/api/cli/sync`};function ne(e,t){let n=t&&t!=="unkn ...

10`),i=sc(r),s=i.length>0?i[0].indent:0,[a]=go(i,0,s);return{data:a,body:o}}function Jt(e){if(!rc(e))return null;try{return ge(oc(e,"utf-8"))}catch{return null}}function ac(e){if(e===null)return"null";if(typeof e=="boolean")return e?"true":"false";if(typeof e=="number")return String(e);let t=String(e);return t===""||/[:#\[\]{}&*!|>'"%@`,]/.test(t)||/^\s|\s$/.test(t)?`"${t.replace(/"/g,'\\"')}"`:t}function ho(e,t,n){let r=" ".repeat(t);for(let[o,i]of Object.entries(e))i!==void 0&&(i!==null&&typeof i=="object"?(n.push(`${r}${o}:`),ho(i,t+1,n)):n.push(`${r}${o}: ${ac(i)}`))}function Un(e,t=""){let ...

11`)?t:`

12${t}`;return n.join(`

13`)+r+(r.endsWith(`

14`)?"":`

15`)}var uc=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function Wn(){return cc()}var dc=new Set(["strapi","wordpress","sanity","contentful","ghost","webflow","shopify","payload","directus","mdx-local","none"]),pc="project.md";function ut(e){return Bn(e,b)}function Xt(e){return Bn(ut(e),pc)}function vo(e){return yo(Xt(e))}function R(e){let t=Jt(Xt(e));if(!t)return null;let n=t.data;if(typeof n.domain!="string"||!n.domain)return null;let r=typeof n.image_provider=="string"?n.image_provider:void 0,o=typeof n.cms=="string"?n.cms:void 0,i=o&&dc.has(o)?o:void 0,s=typeof n.instal ...

16`)}function mc(e){let t={domain:e.domain,site_type:e.site_type,language:e.language,initialized_at:e.initialized_at,seoagent_version:e.seoagent_version};return e.skill_version&&(t.skill_version=e.skill_version),e.install_id&&(t.install_id=e.install_id),e.image_provider&&(t.image_provider=e.image_provider),e.cms&&(t.cms=e.cms),e.blog_path&&(t.blog_path=e.blog_path),e.live_url&&(t.live_url=e.live_url),t}function ko(e,t){let n=ut(e);wo(n,{recursive:!0});let r=Un(mc(t),fc(t));bo(Xt(e),r,"utf-8")}function q(e,t){let n=Xt(e);if(!yo(n))return!1;let r=ge(lc(n,"utf-8")),o={...r.data,...t};return bo(n,Un ...

17`,"utf-8");try{wc(me,384)}catch{}}function Co(){if(!xo(me))return!1;try{return bc(me),!0}catch{return!1}}var kc=new Set([502,503,504]),$c=1e4;async function T(e,t,n={}){let r=Math.max(1,n.attempts??3),o=Math.max(0,n.baseDelayMs??500),i=n.timeoutMs??$c,s=n.fetchImpl??fetch,a=n.sleep??Sc,c=n.transientStatuses??kc,u=null;for(let d=0;d<r;d++){let{init:p,cleanup:f}=xc(t,i);try{let m=await s(e,p);if(c.has(m.status)&&d<r-1){await a(Eo(o,d));continue}return m}catch(m){if(u=m,d<r-1){await a(Eo(o,d));continue}}finally{f()}}throw u instanceof Error?u:new Error(String(u))}function Eo(e,t){return e*Math.po ...

18`,"utf-8"),{file:t,added:i||a,migrated:r}}function Fo(e){let t=xe(e,ct);if(!pt(t))return 0;let n=on(t).hooks;if(!n)return 0;let r=0;for(let o of rn){let i=n[o];if(Array.isArray(i))for(let s of i)for(let a of s.hooks??[])ft(a)&&typeof a.timeout!="number"&&r++}return r}function Uo(e){let t=xe(e,ct);if(!pt(t))return!1;let n=on(t).hooks;return n?rn.some(r=>{let o=n[r];return Array.isArray(o)&&o.some(i=>i.hooks?.some(ft))}):!1}function Bo(e){let t=xe(e,ct);if(!pt(t))return{file:t,removed:!1};let n=on(t),r=n.hooks;if(!r)return{file:t,removed:!1};let o=!1;for(let i of rn){let s=r[i];if(!Array.isArray ...

19`,"utf-8"),{file:t,removed:!0}):{file:t,removed:!1}}import{existsSync as Wo,mkdirSync as Fc,readFileSync as Uc,writeFileSync as Bc}from"fs";import{join as Wc}from"path";function Go(e){return Wo(Wc(e,b,"project.md"))}function Ho(){try{if(!Wo(zt))return[];let e=JSON.parse(Uc(zt,"utf-8"));return Array.isArray(e.projects)?e.projects.filter(t=>typeof t=="string"&&t.length>0):[]}catch{return[]}}function Ko(e){try{Fc(G,{recursive:!0}),Bc(zt,JSON.stringify({projects:e},null,2)+`

20`,"utf-8")}catch{}}function Ce(e){try{if(!Go(e))return;let t=Ho();if(t.includes(e))return;t.push(e),Ko(t)}catch{}}function qo(){let e=Ho(),t=e.filter(Go);return t.length!==e.length&&Ko(t),t}import{readFileSync as qc,writeFileSync as Vc,existsSync as zc}from"fs";import{join as Jo}from"path";function zo(e){let t={business:{},writingInstructions:[],referenceUrls:[],topicsToAvoid:[],contentTone:null,additionalNotes:null},n=Gc(e);for(let[r,o]of n){let i=r.toLowerCase().trim();i==="business context"?t.business=Hc(o):i==="writing instructions"?t.writingInstructions=Vo(o):i==="reference urls"?t.refere ...

21`)}function Gc(e){let t=e.split(`

22`),n=[],r="",o=[];for(let i of t){let s=i.match(/^#\s+(.+)$/);s?(r&&n.push([r,o.join(`

23`)]),r=s[1],o=[]):o.push(i)}return r&&n.push([r,o.join(`

24`)]),n}function Hc(e){let t={},n=e.split(`

25`);for(let r of n){let o=r.match(/^[-*]\s+\*\*(.+?):\*\*\s*(.*)$/);if(o){let i=o[1].toLowerCase().trim(),s=o[2].trim();s&&(t[i]=s)}}return t}function Vo(e){let t=[],n=e.split(`

26`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Kc(e){let t=[],n=e.split(`

27`);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var Xo="context.md";function sn(e){let t=Jo(e,".seoagent",Xo);if(!zc(t))return null;let n=qc(t,"utf-8");return zo(n)}function Yc(e,t){let n=Jo(e,".seoagent",Xo),r=Yo(t);Vc(n,r,"utf-8")}function Qo(e,t){Yc(e,{business:{type:t||""},writingInstructions:[],referenceUrls:[],topicsToAvoid:[],contentTone:null,additionalNotes:null})}import{existsSync as mt,readFileSync as Zo,readdirSync as Jc,statSync as ei}from"fs";import{join as Ee}from"path";var Xc=[{c ...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

28`),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching rows you or the audit have edited. `In sitemap` is refreshed from","the live sitemap; `Status` / `Rendered` / `Word count` are filled by","`seoagent refresh --crawl` (a live fetch of each page). This file syncs to","the cloud on login."].join(`

29`),r="| URL | In sitemap | In nav | Status | Rendered | Word count | Notes |",o="|---|---|---|---|---|---|---|",i=e.map(s=>`| ${s.url} | ${s.in_sitemap} | ${s.in_nav} | ${s.status} | ${s.rendered} | ${s.word_count} | ${s.notes} |`);return[t,"",n,"",r,o,...i,""].join(`

30`)}function Nl(e){let t=new Map,n;try{n=Ol(e,"utf-8")}catch{return t}let r=n.split(/\r?\n/);for(let o=0;o<r.length-1;o++){if(!er(r[o])||!Dl(r[o+1]))continue;let i=hi(r[o]).map(a=>a.toLowerCase()),s={url:i.findIndex(a=>a.includes("url")),in_sitemap:i.findIndex(a=>a.includes("sitemap")),in_nav:i.findIndex(a=>a.includes("nav")),status:i.findIndex(a=>a.includes("status")||a.includes("http")),rendered:i.findIndex(a=>a.includes("render")),word_count:i.findIndex(a=>a.includes("word")),notes:i.findIndex(a=>a.includes("note"))};if(s.url===-1)return t;for(let a=o+2;a<r.length&&er(r[a]);a++){let c=hi(r[a ...

31`))}import{existsSync as xi}from"fs";import{intro as Kl,outro as ql,confirm as Vl,isCancel as zl,cancel as Yl}from"@clack/prompts";import{existsSync as pn,rmSync as Hl}from"fs";import{join as fn}from"path";function $i(

32`);if(!r){Kl("SEOAgent \u2014 uninstall"),l.message(`This will remove:

33${o}`);let s=await Vl({message:"Remove these and start fresh?"});if(zl(s)||!s){Yl("Cancelled \u2014 nothing was removed.");return}}Si(t,n);let i=n.map(s=>` \u2713 ${s.label}`).join(`

34`);r?l.success(`Removed:

35${i}`):ql(`Removed:

36${i}`),!e.global&&xi(G)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-install any time with \`${g("init")}\`.`)}import C from"picocolors";import{existsSync as bt,readdirSync as nr,statSync as Jl,readFileSync as _i}from"fs";import{join as qe}from

37`)}function iu(e,t){if(!t)return ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ei(t),r=e-5-n;return r<1?ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${ye.dim("\u250C\u2500 ")}${t}${ye.dim(` ${"\u2500".repeat(r)}\u2510`)}`}function su(e,t){let n=Ei(e),r;return n<=t?r=e+" ".repeat(t-n):r=e,`${ye.dim("\u2502")} ${r} ${ye.dim("\u2502")}`}function rr(e){let t=Date.now()-new Date(e).getTime(),n=Math.floor(t/6e4);if(n<60)return`${n} minutes ago`;let r=Math.floor(n/60);return r<24?`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L26

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L26

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L26

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

39Live: ${e.canonical}`:"",o=[`# ${e.title}`,"",`Tracked record \u2014 this article is **${e.status}** and ${n}.`,"This is a pointer so the cloud dashboard can track it without duplicating","the body. Edit the source file to change the article."+r,""].join(`

40`);return`${t.join(`

41`)}

43${o}

44`}function Li(e,t){let n=ze(e,b,"content"),r=ir(n),o=new Set;for(let c of r)c.source==="repo"&&c.repo_path&&o.add(Nu(c.repo_path));if(o.size===0)return{tracked:[]};let i=[...o].

45action_id: ${e.id}

46action_type: ${e.action_type}

47article_id: ${n}

48slug: ${r??""}

49cms_type: ${s??""}

50created_at: ${e.created_at}

51---

53# Prune action \u2014 ${o??`article ${n}`}

55SEOAgent's auto-prune determined that this article should be removed from

56your repo. The cloud has already marked it pruned in your dashboard and

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

index.jsView file

26`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Kc(e){let t=[],n=e.split(` L27: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var Xo="context.md";function sn... L28: `),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching r... ... L36: ${i}`),!e.global&&xi(G)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-i... L37: `)}function iu(e,t){if(!t)return ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ei(t),r=e-5-n;return r<1?ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${ye.dim("\u250C\u2500 ... L38:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L26

26Trigger-reachable chain: manifest.main -> index.js L26: `);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Kc(e){let t=[],n=e.split(` L27: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\/\S+)(?:\s+[—–-]\s+(.+))?$/);o&&t.push({url:o[1].trim(),description:o[2]?.trim()||""})}return t}var Xo="context.md";function sn... L28: `),n=["# Pages","","Inventory of pages discovered in your codebase. Re-running `seoagent init`","or `seoagent refresh` re-scans and merges in newly-added pages without","touching r... ... L36: ${i}`),!e.global&&xi(G)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-i... L37: `)}function iu(e,t){if(!t)return ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ei(t),r=e-5-n;return r<1?ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${ye.dim("\u250C\u2500 ... L38:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L26

36${i}`),!e.global&&xi(G)&&l.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),l.info(`Re-i... L37: `)}function iu(e,t){if(!t)return ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ei(t),r=e-5-n;return r<1?ye.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${ye.dim("\u250C\u2500 ... L38:

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L26

8.sync.lock L9: `,Ja=process.env.XDG_CONFIG_HOME&&process.env.XDG_CONFIG_HOME.trim().length>0?process.env.XDG_CONFIG_HOME:je(Ya(),".config"),G=je(Ja,"seoagent"),me=je(G,"auth.json"),Mn=je(G,"state... L10: `),i=sc(r),s=i.length>0?i[0].indent:0,[a]=go(i,0,s);return{data:a,body:o}}function Jt(e){if(!rc(e))return null;try{return ge(oc(e,"utf-8"))}catch{return null}}function ac(e){if(e==... ... L15: `)}var uc=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function Wn(){return cc()}var dc=new Set(["strapi","wordpress","sanity","contentful","ghost","webflow","... L16: `)}function mc(e){let t={domain:e.domain,site_type:e.site_type,language:e.language,initialized_at:e.initialized_at,seoagent_version:e.seoagent_version};return e.skill_version&&(t.s... L17: `,"utf-8");try{wc(me,384)}catch{}}function Co(){if(!xo(me))return!1;try{return bc(me),!0}catch{return!1}}var kc=new Set([502,503,504]),$c=1e4;async function T(e,t,n={}){let r=Math.... ... L26: `);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Kc(e){let t=[],n=e.split(` L27: `);for(let r of n){let o=r.match(/^[-*]\s+(https?:\/\

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

Findings

2 Critical3 High3 Medium2 Low

CriticalSame File Env Network Executionindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js

HighCommand Output Exfiltrationindex.js

HighSandbox Evasion Gated Capabilityindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

index.jsView file

Lines 1-56javascript

1#!/usr/bin/env node

3.legacy/

4content/images/*

5!content/images/.gitkeep

6.pull-receipt.json

7.ack-queue.json

8.sync.lock

11`)?t:`

12${t}`;return n.join(`

13`)+r+(r.endsWith(`

14`)?"":`

21`)}function Gc(e){let t=e.split(`

22`),n=[],r="",o=[];for(let i of t){let s=i.match(/^#\s+(.+)$/);s?(r&&n.push([r,o.join(`

23`)]),r=s[1],o=[]):o.push(i)}return r&&n.push([r,o.join(`

24`)]),n}function Hc(e){let t={},n=e.split(`

25`);for(let r of n){let o=r.match(/^[-*]\s+\*\*(.+?):\*\*\s*(.*)$/);if(o){let i=o[1].toLowerCase().trim(),s=o[2].trim();s&&(t[i]=s)}}return t}function Vo(e){let t=[],n=e.split(`

26`);for(let r of n){let o=r.match(/^[-*]\s+(.+)$/);if(o){let i=o[1].trim();(!i.startsWith("(")||!i.endsWith(")"))&&t.push(i)}}return t}function Kc(e){let t=[],n=e.split(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L8

32`);if(!r){Kl("SEOAgent \u2014 uninstall"),l.message(`This will remove:

33${o}`);let s=await Vl({message:"Remove these and start fresh?"});if(zl(s)||!s){Yl("Cancelled \u2014 nothing was removed.");return}}Si(t,n);let i=n.map(s=>` \u2713 ${s.label}`).join(`

34`);r?l.success(`Removed:

35${i}`):ql(`Removed:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L26

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L26

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

index.jsView on unpkg · L26

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L36

40`);return`${t.join(`

41`)}

43${o}

44`}function Li(e,t){let n=ze(e,b,"content"),r=ir(n),o=new Set;for(let c of r)c.source==="repo"&&c.repo_path&&o.add(Nu(c.repo_path));if(o.size===0)return{tracked:[]};let i=[...o].

45action_id: ${e.id}

46action_type: ${e.action_type}

47article_id: ${n}

48slug: ${r??""}

49cms_type: ${s??""}

50created_at: ${e.created_at}

51---

53# Prune action \u2014 ${o??`article ${n}`}

55SEOAgent's auto-prune determined that this article should be removed from

56your repo. The cloud has already marked it pruned in your dashboard and

Long lines were clipped for display.