Claude Code, Skill
Seo Aeo Audit
Audit search and answer-engine visibility with evidence, then return a prioritized change plan.
Compatibility: Not stated.
Grade B
Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
PERMISSION_DELETE_FILES NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST SECRETS_PATH_DOTENV
Why this grade
- PERMISSION_DELETE_FILES Low
Contains a call that can delete files.
bin/seo-aeo-audit.js, line 93
fs.rmSync(dest, { recursive: true, force: true }); - NETWORK_NO_FIXED_HOST Low
Makes a network call whose host is not written as a fixed address.
docs/evidence/plans/fw06-transport-probe.py, line 45
observe('page conflicting lengths',lambda:{'truncated':m.fetch(origin+'/page',5,m.DEFAULT_UA,4096)[2]}) - NETWORK_UNNAMED_HOST Low
Calls a fixed host that the description does not name.
docs/evidence/plans/fw06-transport-probe.py, line 45
observe('page conflicting lengths',lambda:{'truncated':m.fetch(origin+'/page',5,m.DEFAULT_UA,4096)[2]}) - SECRETS_PATH_DOTENV Low
Mentions a .env file.
.gitignore, line 14
# untracked-but-unignored .env at a sibling's repo root, one `git add -A`
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
bin/seo-aeo-audit.js, line 93
fs.rmSync(dest, { recursive: true, force: true });
docs/evidence/plans/fw06-attribution-inventory.py, line 22
sha = subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=ROOT, text=True).strip()
docs/evidence/plans/fw06-attribution-inventory.py, line 24
committed = subprocess.check_output(['git', 'show', sha + ':' + path], cwd=ROOT)
Show more
docs/evidence/runs/2026-10-13-shared-header-truth/reproduce.py, line 12
original=subprocess.check_output(['git','show','5e9f6af67f9f01f70250465d63b0bb5f04983229:test/'+name],text=True)
plugins/seo-aeo-audit/skills/seo-aeo-audit/scripts/gsc_pull.py, line 359
out = subprocess.run(
plugins/seo-aeo-audit/skills/seo-aeo-audit/scripts/preflight.py, line 517
out = subprocess.run(
plugins/seo-aeo-audit/skills/seo-aeo-audit/scripts/url_inspection.py, line 174
out = subprocess.run(
.github/workflows/validate.yml, line 1037
subprocess.run(
SECURITY.md, line 132
| 13 | the three `subprocess.run` blocks that call `gcloud`, with timeout/error branches and bootstrap containment - 4 lines in `gsc_pull.py`, 6 in `url_inspection.py` (two more ca
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address. can reach example.invalid. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
docs/evidence/plans/fw06-transport-probe.py, line 45
observe('page conflicting lengths',lambda:{'truncated':m.fetch(origin+'/page',5,m.DEFAULT_UA,4096)[2]})
docs/evidence/plans/fw06-transport-probe.py, line 46
r[0]),'budget':128,'truncated':r[2]})(m.fetch(origin+'/gzip-page',5,m.DEFAULT_UA,128))
docs/evidence/plans/fw06-transport-probe.py, line 47
m=mods['agent_surface'];observe('agent conflicting lengths',lambda:(lambda p:{'status':p.status,'body_complete':p.body_complete})(m.fetch(origin+'/agent')))
Show more
docs/evidence/plans/fw06-transport-probe.py, line 48
m=mods['sitemap_audit'];observe('sitemap conflicting lengths',lambda:{'parseable_page_count':len(m.parse_sitemap(m.fetch(origin+'/sitemap'))[0])})
docs/evidence/plans/fw06-transport-probe.py, line 50
urement':m.useful_measurement(m.parse(m.fetch('https://example.invalid','mobile',None)
plugins/seo-aeo-audit/skills/seo-aeo-audit/references/discover.md, line 170
curl -s "$URL" | grep -iE 'nopagereadaloud|notranslate|<html[^>]*translate="no"'
plugins/seo-aeo-audit/skills/seo-aeo-audit/references/discover.md, line 173
curl -s "$URL" | grep -iE 'max-image-preview|og:image|og:title'
plugins/seo-aeo-audit/skills/seo-aeo-audit/references/discover.md, line 176
IMG=$(curl -s "$URL" | grep -oP '(?<=og:image" content=")[^"]+')
plugins/seo-aeo-audit/skills/seo-aeo-audit/references/playbooks.md, line 328
curl -s https://example.com/de/entity | grep -c 'href="/de/help/code-not-arriving"'
plugins/seo-aeo-audit/skills/seo-aeo-audit/references/technical-checks.md, line 669
curl -s https://example.com/sitemap.xml | xmllint --noout - # well-formed?
plugins/seo-aeo-audit/skills/seo-aeo-audit/references/technical-checks.md, line 670
curl -s https://example.com/sitemap.xml | grep -c '<loc>' # count vs expectation
plugins/seo-aeo-audit/skills/seo-aeo-audit/references/technical-checks.md, line 671
curl -s https://example.com/sitemap.xml | grep -oE '<loc>[^<]*&[^a][^m][^p]' | head
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_DOTENV
.gitignore, line 10
# agent-sync - local credentials and run state, never committed
.gitignore, line 14
# untracked-but-unignored .env at a sibling's repo root, one `git add -A`
.gitignore, line 15
# away from a public repository. The hole was open in all nine.
Show more
.gitignore, line 16
.env
.gitignore, line 18
!.env.example
CHANGELOG.md, line 799
This release also carries the untagged `.env` gitignore hardening, which had been sitting
docs/AGENT_SYNC.md, line 22
- credentials read from `.env.agent-sync` in sshlg-skills - gitignored, never committed
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 0cde64ee0270. can delete files. can reach a host that is not written as a fixed address. can reach example.invalid. The description does not name that host. reads a credential or environment file.
Date and source
Date checked:
github.com
Commit graded: 0cde64ee02708b407ccd87489e2d3940641b72fa
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.