by 安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to be a legitimate SEO/GEO audit framework, but the package contains inconsistent metadata about what it actually requires. Before installing or supplying credentials: 1) Ask the author (or check the referenced GitHub repo) whether SERPAPI_API_KEY and python3 are truly optional or required at runtime. 2) Avoid pasting any unrelated secrets — only provide an API key if you intend the skill to perform search-result enrichment. 3) If you must test it, do so without credentials fi...详细分析 ▾
ℹ 用途与能力
The skill's name, README, and SKILL.md content align with an SEO/GEO audit workflow. Asking for SERPAPI search enrichment and optional local tooling (python3) is plausible for richer audits, but the registry metadata says 'Required env vars: none' while SKILL.md header declares SERPAPI_API_KEY as primaryEnv — that mismatch is unexpected.
✓ 指令范围
SKILL.md instructions describe only observable site crawling, on-page checks, off-site visibility checks, and explicitly say not to claim access to Search Console, analytics, or private logs. There are no instructions to read unrelated system files or exfiltrate secrets in the documented runtime steps.
✓ 安装机制
This is an instruction-only skill with no install spec or code files to execute; nothing would be downloaded or written to disk by an installer. That limits the execution surface compared with skills that install binaries.
⚠ 凭证需求
Inconsistent declarations: the registry lists no required env vars, but SKILL.md header sets primaryEnv: SERPAPI_API_KEY and requires.env includes SERPAPI_API_KEY; the SKILL.md body then describes SERPAPI_API_KEY as optional. Similarly, SKILL.md lists 'python3' under required bins but the registry reported none. Requesting a SERPAPI API key is reasonable for optional search enrichment, but the contradictory metadata could cause unexpected credential requests or misconfiguration. Be cautious about providing any API keys without confirmation.
✓ 持久化与权限
Flags show always: false and user-invocable: true; the skill does not request permanent/forced inclusion. There are no instructions to modify other skills or system-wide agent settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/9
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install seo-geo-audit
镜像加速npx clawhub@latest install seo-geo-audit --registry https://cn.longxiaskill.com✓ 镜像可用