registry / Credential exfiltration / @seoagent-official/seoagent / 1.88.1

@seoagent-official/seoagent@1.88.1

The persistent AI SEO agent for Claude Code. Audits, keyword strategy, briefs, articles, real product screenshots from your repo, and the autopilot loop (cloud detects → CLI executes → ack closes) — other SEO tools write the prompt, SEOAgent runs it.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

The source supports a conditional credential-forwarding risk: an operator-configured API base can receive the account bearer token without an enforced destination allowlist. The explicit configuration and account connection flow do not establish covert exfiltration, so this warrants a warning rather than a block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The CLI is run with SEOAGENT_API_BASE set and performs login or an authenticated API operation.

Impact

Credentials may be disclosed to an unintended endpoint if the caller configures an untrusted base URL. The code inspected does not establish covert theft.

Mechanism

The configured URL is used as the API base without an enforced destination allowlist; bearer credentials are sent in request headers.

AI rationale

Evidence

index.js

Network endpoints1

seoagent.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The entrypoint accepts SEOAGENT_API_BASE as the service base URL without a destination allowlist.
Login and authenticated API calls use the selected base URL and send the account bearer token in the Authorization header.
The CLI prompts the user to connect an account before completing login; this does not bind a configured base URL to the intended service.

Evidence against

The manifest defines a CLI entrypoint and no npm lifecycle hooks.
The inspected source does not show a hidden or default credential export to an unrelated recipient.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 298 KB of source, external domains: 127.0.0.1, api.openai.com, api.replicate.com, console.anthropic.com, example.com, fal.run, registry.npmjs.org, seoagent.com, www.google.com

Source & flagged code

7 flagged

index.jsView file

79- Bundle scaffolded. L80: `,"utf-8"),r.push("log.md")),{created:r,okfDir:n}}import{log as ct}from"@clack/prompts";var u={info:e=>ct.info(e),warn:e=>ct.warn(e),error:e=>ct.error(e),success:e=>ct.success(e),s... L81: `))}import{existsSync as Is}from"fs";import{intro as Td,outro as Od,confirm as Ld,isCancel as jd,cancel as Nd}from"@clack/prompts";import{existsSync as Fn,rmSync as Id}from"fs";imp... ... L86: ${o}`),!e.global&&Is(G)&&u.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),u.info(`Re-i... L87: `)}function qd(e,t){if(!t)return je.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ls(t),r=e-5-n;return r<1?je.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${je.dim("\u250C\u2500 ... L88:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L79

86Trigger-reachable chain: manifest.main -> index.js L86: ${o}`),!e.global&&Is(G)&&u.info("Your seoagent.com login (~/.config/seoagent/) was kept \u2014 it is shared across projects. Run `uninstall --global` to wipe it too."),u.info(`Re-i... L87: `)}function qd(e,t){if(!t)return je.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`);let n=Ls(t),r=e-5-n;return r<1?je.dim(`\u250C${"\u2500".repeat(e-2)}\u2510`):`${je.dim("\u250C\u2500 ... L88:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

2 Critical6 High3 Medium2 Low

CriticalSame File Env Network Executionindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js

HighShell

HighCommand Output Exfiltrationindex.js

HighSandbox Evasion Gated Capabilityindex.js

HighTrigger Reachable Command Output Exfiltrationindex.js

HighSemantic Analysis Limitedindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @seoagent-official/seoagent@1.88.1.

See all versions of @seoagent-official/seoagent for other recorded verdicts.

Review the evidence and your use of @seoagent-official/seoagent@1.88.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 21:03:35.360Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / Credential exfiltration / @seoagent-official/seoagent / 1.88.1

@seoagent-official/seoagent@1.88.1

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The CLI is run with SEOAGENT_API_BASE set and performs login or an authenticated API operation.

Impact

Credentials may be disclosed to an unintended endpoint if the caller configures an untrusted base URL. The code inspected does not establish covert theft.

Mechanism

The configured URL is used as the API base without an enforced destination allowlist; bearer credentials are sent in request headers.

AI rationale

Evidence

index.js

Network endpoints1

seoagent.com

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The entrypoint accepts SEOAGENT_API_BASE as the service base URL without a destination allowlist.
Login and authenticated API calls use the selected base URL and send the account bearer token in the Authorization header.
The CLI prompts the user to connect an account before completing login; this does not bind a configured base URL to the intended service.

Evidence against

The manifest defines a CLI entrypoint and no npm lifecycle hooks.
The inspected source does not show a hidden or default credential export to an unrelated recipient.

Behavioral surface

Source

ChildProcessEnvironmentVarsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 298 KB of source, external domains: 127.0.0.1, api.openai.com, api.replicate.com, console.anthropic.com, example.com, fal.run, registry.npmjs.org, seoagent.com, www.google.com

Source & flagged code

7 flagged

index.jsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

index.jsView on unpkg · L79

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

Findings

2 Critical6 High3 Medium2 Low

CriticalSame File Env Network Executionindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js

HighShell

HighCommand Output Exfiltrationindex.js

HighSandbox Evasion Gated Capabilityindex.js

HighTrigger Reachable Command Output Exfiltrationindex.js

HighSemantic Analysis Limitedindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @seoagent-official/seoagent@1.88.1.

See all versions of @seoagent-official/seoagent for other recorded verdicts.

Review the evidence and your use of @seoagent-official/seoagent@1.88.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 21:03:35.360Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

AI Security Review

Decision evidence

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface