Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Seo Skill Security Audit

What the author says it does (original text)

Optimize for search engine visibility and ranking. Use when asked to "improve SEO", "optimize for search", "fix meta tags", "add structured data", "sitemap optimization", or "search engine optimization".

Independent security check

Security risks found

Files checked
2
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

The robots.txt example exposes sensitive-looking paths and may be mistaken for access control

Source references: 2
What we found

The example labels `/admin/`, `/api/`, and `/private/` as areas to “block.” robots.txt is a public crawler hint; it does not stop browsers, attackers, or noncompliant bots, and listing paths can make them easier to discover.

Why this matters

If copied and relied upon for protection, administrative, API, or private pages may remain directly reachable while compliant search crawlers stop visiting them.

This is a configuration example under “Crawlability,” not implemented access control, but it explicitly lists admin, API, and private paths in a public robots.txt. Only compliant crawlers honor these directives; browsers and malicious visitors are not blocked. Copying it could disclose path names and create a false sense of protection. Users can ask the author to state that these areas still require authentication and server-side authorization, and to avoid listing sensitive paths unnecessarily.

SKILL.md:41In the instructionsOpen original file
```text# /robots.txtUser-agent: *Allow: /# Block admin/private areasDisallow: /admin/Disallow: /api/Disallow: /private/
Show 1 other places
SKILL.md:39In the instructionsOpen original file
**robots.txt:**```text# /robots.txtUser-agent: *Allow: /# Block admin/private areasDisallow: /admin/Disallow: /api/Disallow: /private/
Medium risk

Blanket HSTS and frame denial presented as SEO can break existing services

Source references: 1
What we found

The skill directly recommends HSTS with `includeSubDomains` and `X-Frame-Options: DENY` without requiring an inventory of subdomain HTTPS support or legitimate embedding needs. These are site-wide browser security controls, not merely SEO metadata.

Why this matters

HTTP-only subdomains may become unreachable in HSTS-aware browsers, and legitimate payment, authentication, partner-portal, or other iframe-based flows may stop working.

These are documentation examples and do not modify a site by themselves, but they are presented as SEO “trust signals” without deployment checks. HSTS with `includeSubDomains` makes browsers require HTTPS for every subdomain, potentially breaking subdomains that still depend on HTTP. `X-Frame-Options: DENY` blocks all framing and can disrupt trusted integrations. Users can ask for a subdomain HTTPS inventory, staged HSTS rollout, and embedding-requirement review, with security-policy changes approved separately from SEO edits.

SKILL.md:141In the instructionsOpen original file
**Security headers for SEO trust signals:**```Strict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffX-Frame-Options: DENY```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The pagination canonical example could remove deeper pages from search coverage

Source references: 1
What we found

The skill shows paginated content canonicalized to `/products`. If later pages contain different products or content, a search engine may treat them as duplicates of the first page instead of independently discoverable pages. It mentions `prev`/`next` but does not require checking whether the pages are truly duplicates.

Why this matters

Products and content on deeper pages may become harder to discover or index, reducing organic-search exposure and potential revenue.

This is an example rather than automatic behavior, but it points the canonical for “paginated content” to the collection page without limiting that advice to true duplicates. If later pages contain unique products or content, copying it may cause search engines to consolidate them into `/products`, reducing independent discovery or indexing. The optional `prev`/`next` note does not remove that risk. Users can ask the author to verify each pagination template and default to self-referencing canonicals unless pages are genuinely duplicates.

SKILL.md:71In the instructionsOpen original file
**Canonical URLs:**```html<!-- Prevent duplicate content issues --><link rel="canonical" href="https://example.com/page"><!-- Self-referencing canonical (recommended) --><link rel="canonical" href="https://example.com/current-page"><!-- For paginated content --><link rel="canonical" href="https://example.com/products"><!-- Or use rel="prev" / rel="next" for explicit pagination -->```

Inside this skill

8 instruction sections

The skill audits rendered pages, headers, redirects, robots.txt, sitemaps, canonicals, and structured data; it checks Search Console only when the user provides access. It then instructs the agent to change source files and retest, so an “audit” may include actual code changes.

View source
SKILL.md:18In the instructionsOpen original file
1. Run live Lighthouse SEO and Agentic Browsing checks when that capability is available; with Chrome DevTools MCP, use `lighthouse_audit`. Use the results to localize rendered-page failures.2. Inspect signals Lighthouse cannot establish on its own: response headers, redirects, `robots.txt`, sitemap coverage, canonical consistency across page templates, structured-data eligibility, and Search Console evidence when the user provides access.3. Separate technical crawl/index findings from content quality and authority. Do not invent ranking-factor weights or promise ranking changes.4. Fix the source and re-run the same checks. For indexation or ranking outcomes, report that search-engine validation remains pending.

The skill says structured data must describe visible, accurate content and that valid syntax does not guarantee rich-result display. This reduces the risk of treating example companies, prices, ratings, or reviews as real data.

View source
SKILL.md:256In the instructionsOpen original file
Read [the structured data reference](references/STRUCTURED-DATA.md) when the user requests schema markup or an audit surfaces a structured-data issue. It contains Organization, Article, Product, FAQ, and Breadcrumb examples plus validation links.* **Describe visible, accurate content.** Do not add a type or claim solely to obtain a rich result.* **Use the most specific applicable type.** Keep identifiers and absolute URLs stable across renders.* **Validate rendered output.** Passing syntax does not guarantee search-engine eligibility or display.
references/STRUCTURED-DATA.md:3In the instructionsOpen original file
Use the type that matches the page's visible content and current search-feature eligibility. These examples are starting points; verify required and recommended properties against maintained Google Search and Schema.org documentation.

For AI crawlers and WebMCP, the skill calls for product-specific decisions and says tools should be added only when the application has useful actions to expose and the user wants the integration. It does not equate AI crawlability with guaranteed ranking or citation.

View source
SKILL.md:266In the instructionsOpen original file
* **Lighthouse Agentic Browsing** measures technical signals that help an assistant understand and interact with the rendered page. Current checks include the agent-facing accessibility tree, optional `llms.txt`, and WebMCP registrations, schemas, and form coverage when present.* **Search indexing and ranking** depend on search-engine systems and cannot be inferred from the Agentic Browsing score.* **AI ingestion or citation** is product-specific. A technically browsable page or valid `llms.txt` file does not prove that an AI product will ingest, rank, or cite it.Prioritize semantic HTML, descriptive labels, crawlable content, accurate metadata, and clear page structure because they benefit people, search engines, and agents. Add WebMCP tools only when the application has useful actions to expose and the user wants that integration; validate tool names, descriptions, schemas, and form annotations with Lighthouse.

The supplied files contain instructions, configuration snippets, and structured-data examples, but no installer, executable script, credential-reading code, or upload implementation. Any network access or website modification depends on how the hosting agent carries out the instructions.

View source
SKILL.md:393In the instructionsOpen original file
## Tools| Tool | Use ||------|-----|| Google Search Console | Monitor indexing, fix issues || Google PageSpeed Insights | Performance + Core Web Vitals || Rich Results Test | Validate structured data || Live Lighthouse audit (Chrome DevTools MCP: `lighthouse_audit`) | Rendered SEO and Agentic Browsing checks for agents || Lighthouse CLI | SEO audit fallback || Screaming Frog | Crawl analysis |
Start here · InstructionsSKILL.md
seo
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/STRUCTURED-DATA.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/STRUCTURED-DATA.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:53In the instructionsOpen original file
Sitemap: https://example.com/sitemap.xml```
SKILL.md:74In the instructionsOpen original file
<!-- Prevent duplicate content issues --><link rel="canonical" href="https://example.com/page">
SKILL.md:77In the instructionsOpen original file
<!-- Self-referencing canonical (recommended) --><link rel="canonical" href="https://example.com/current-page">
Lines read
564
File checksum (to compare versions)
b89bdf1549bfdc69f43db5806c3e67b8bdcd4a7955bf1cb36a57cf444107ba1b