All In One Free Seo Tool

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Serious

  install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.

  INSTALL_REMOTE_SCRIPT INSTALL_DOCUMENTED_INSTALLER

  README.md, line 85

  curl -fsSL https://raw.githubusercontent.com/IamRamgarhia/All-In-One-Free-SEO-Tool/main/install.sh | bash

  install.sh, line 3

  # curl -fsSL https://raw.githubusercontent.com/IamRamgarhia/All-In-One-Free-SEO-Tool/main/install.sh | bash

  docs/TROUBLESHOOTING.md, line 61

  SEO_PORT=4000 curl -fsSL https://raw.githubusercontent.com/IamRamgarhia/All-In-One-Free-SEO-Tool/main/install.sh | bash

  Show more

  docs-site/content.mjs, line 172

  <pre><code>curl -fsSL ${REPO.replace("github.com", "raw.githubusercontent.com")}/main/install.sh | bash</code></pre>

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  install.sh, line 86

  # ---- 0. preflight (only need curl/wget + unzip + tar) -----------------------

  install.sh, line 89

  if command -v curl >/dev/null 2>&1; then

  install.sh, line 91

  elif command -v wget >/dev/null 2>&1; then

  Show more

  install.sh, line 94

  die "Need curl or wget. Install curl (most distros have it built-in)."

  install.sh, line 111

  curl -fsSL "$ZIP_URL" -o "$TMP_ZIP" || die "Download failed. Check your internet connection."

  install.sh, line 113

  wget -q "$ZIP_URL" -O "$TMP_ZIP" || die "Download failed."

  install.sh, line 253

  if curl -fsS -o /dev/null "http://localhost:$PORT/api/v1/health" 2>/dev/null; then

  install.sh, line 282

  Ubuntu/Debian: curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt install -y nodejs

  install.sh, line 496

  if curl -fsS -o /dev/null "http://localhost:$PORT/api/v1/health" 2>/dev/null; then

  bin/START.sh, line 119

  HEALTH_BODY="$(curl -fsS --max-time 2 "$health_url" 2>/dev/null || true)"

  docs-site/assets/docs.js, line 108

  fetch(base + "search-index.json")

  scripts/agent-wp-check.ts, line 97

  const res = await fetch(`http://localhost:${WP_PORT}/seo-tool/v1${path}`, {

  scripts/agent-wp-check.ts, line 108

  const r = await fetch(`http://localhost:${WP_PORT}/seo-tool/v1/ping`, {

  scripts/agent-wp-check.ts, line 121

  const r = await fetch(`http://localhost:${port}/api/chat`, {

  scripts/agent-wp-check.ts, line 141

  const r = await fetch(`http://localhost:${port}/api/chat`, {

  scripts/agent-wp-check.ts, line 456

  const linkedPage = await fetch(`http://localhost:${WP_PORT}/hello-world`);

  scripts/agent-wp-check.ts, line 527

  const afterUndo = await fetch(`http://localhost:${WP_PORT}/hello-world`);

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  install.ps1, line 400

  # interactive prompt OR allowlisted in package.json. Various .npmrc

  install.ps1, line 583

  if (-not (Test-Path ".env.local")) {

  install.ps1, line 584

  if (Test-Path ".env.example") {

  Show more

  install.ps1, line 585

  Copy-Item ".env.example" ".env.local"

  install.ps1, line 930

  .env.local <- env config (APP_PASSWORD, custom env vars)

  install.ps1, line 979

  Want a password? Set APP_PASSWORD=yourpassword in $dir\.env.local then restart.

  install.ps1, line 982

  in $dir\.env.local, then restart.

  install.ps1, line 984

  Forgot password? Edit $dir\.env.local, remove the APP_PASSWORD line, restart.

  scripts/wp-bridge-check.ts, line 69

  key: process.env.SEO_WP_KEY ?? "fake-bridge-key",

  src/instrumentation.ts, line 25

  ensureSessionSecret(); // also assigns process.env.SEO_SESSION_SECRET

  src/middleware.ts, line 199

  const required = process.env.APP_PASSWORD;

  src/middleware.ts, line 207

  const secret = process.env.SEO_SESSION_SECRET;

  src/app/api/auth/login/route.ts, line 51

  const required = process.env.APP_PASSWORD;

  src/app/api/auth/mode/route.ts, line 37

  : process.env.APP_PASSWORD

  src/app/api/auth/status/route.ts, line 15

  enabled: accounts || Boolean(process.env.APP_PASSWORD),

  src/app/api/auth/status/route.ts, line 16

  mode: accounts ? "accounts" : process.env.APP_PASSWORD ? "password" : "open",

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  pnpm-lock.yaml, line 1

  lockfileVersion: '9.0'

  src/app/image-audit/c/[clientId]/page.tsx, line 1

  "use client";

  src/lib/__fixtures__/serp/google-sorry-rendered.html, line 1

  <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="origin-trial" content="A7vZI3v+Gz7JfuRolKNM4Aff6zaGuT7X0mf3wtoZTnKv6497cVMnhy03KDqX7kBz

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit b80e0af9eb14. install fetches a script from the network. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. accepts a host from input, with no fixed list in this file. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen