Back to plugin
Pluginv8.0.1
ClawScan security
Deprecated · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 17, 2026, 10:00 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is a content-only SEO/GEO skill collection: its requirements, instructions, and optional integrations are consistent with the stated purpose and it does not demand unexplained credentials or installers.
- Guidance
- This package is a large collection of text-only SEO/GEO skill definitions and documentation — it is internally consistent with that purpose. Before installing: (1) note the plugin is marked [DEPRECATED] in plugin.json and points to a new slug (aaron-seo-geo) — consider installing the maintained package instead; (2) review memory/hot-cache.md and the memory directory if you don't want local project context auto-loaded into agent sessions; (3) if you enable MCP connectors (.mcp.json / CONNECTORS.md), only then will external API keys or OAuth be required — review and provide those credentials yourself and only for services you trust; (4) the repo includes developer scripts (validate-skill.sh, validate-descriptions.py) that are not run automatically by the agent — run them manually if you want to validate SKILL.md files. If any of these behaviors are unacceptable, do not install or install a trimmed fork containing only the skills you need.
Review Dimensions
- Purpose & Capability
- okName/description (SEO & GEO skills library) match the repository contents: many SKILL.md files, docs, and optional connectors. The repo declares zero required env vars and no required binaries; that aligns with the stated 'zero dependencies / pure markdown' claim. The presence of developer validation scripts is reasonable for a documentation skillset and does not contradict the purpose.
- Instruction Scope
- noteRuntime SKILL.md instructions are Markdown and prompt-level hooks; they describe loading local memory files (memory/hot-cache.md) and using optional MCP connectors. That fits the skill purpose. Note: the library's operating model auto-loads a HOT memory file into sessions by design — this is expected for the skill but means local project files may be read into the agent context when the skill is used.
- Install Mechanism
- okNo install spec is provided (instruction-only skill). All install methods cited are standard (clawhub, npx skills, git clone, plugin loading) and there are no downloads from untrusted URLs or archive extraction steps in the manifest.
- Credentials
- noteThe skill itself requires no environment variables and declares no primary credential. The repo includes an .mcp.json listing optional MCP servers (Ahrefs, Semrush, Cloudflare, etc.) and documentation (CONNECTORS.md) explaining that connecting those services requires API keys or OAuth. Requiring those credentials would be proportional only if you enable those integrations; they are not required for the library to function at Tier 1 (manual input).
- Persistence & Privilege
- notealways:false (normal). The library defines a memory model (HOT/WARM/COLD) and prompt-based hooks that may auto-load local memory/hot-cache.md into sessions. This is not a global privilege escalation, but it does mean the skill can bring local project data into the agent context when invoked. If you are uncomfortable with that, disable the skill or remove/clean the memory files.