Is Agentic Seo Skill safe?
- Python shell/command execution
- Python network egress
- Python filesystem read
agentic-seo-skill is an AI python_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 5 risky constructs are reported for review. It can: delegated authentication, filesystem read, filesystem write, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
agentic-seo-skill 3.0.1
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Agentic Seo Skill's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (5)
The component can run operating-system commands or spawn processes.
result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
result = subprocess.run(
["gh", "--version"],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,
check=False,
text=True,
)result = subprocess.run(
["gh", "auth", "status", "-h", "github.com"],
capture_output=True,
text=True,
check=False,
timeout=12,
)output = subprocess.check_output(
["git", "remote", "get-url", "origin"],
cwd=cwd,
stderr=subprocess.DEVNULL,
text=True,
).strip()result = subprocess.run(
cmd,
input=input_data,
capture_output=True,
text=True,
timeout=timeout,
check=False,
)result = subprocess.run(cmd, capture_output=True, text=True, check=False)
completed = subprocess.run(args, check=False, capture_output=True, text=True, timeout=timeout)
output = subprocess.check_output(
["git", "for-each-ref", "--sort=-creatordate", "--format=%(refname:short)%09%(creatordate:iso8601)", f"--count={limit}", "refs/tags"],
cwd=cwd,
stderr=subprocess.DEVNULL, …Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.
The component reads files from disk.
with open(source, "r", encoding="utf-8") as fh:
return path.read_text(encoding="utf-8"), "", {"url": source, "status": None, "headers": {}, "error": None}with open(source, "r", encoding="utf-8") as fh:
with open(path, newline="", encoding="utf-8-sig") as fh:
with open(source, "r", encoding="utf-8") as fh:
return path.read_text(encoding="utf-8"), "", {"url": source, "status": None, "headers": {}, "error": None}with open(source, "r", encoding="utf-8") as fh:
text = path.read_text(encoding="utf-8")
with open(path, "r", encoding="utf-8") as fh:
with open(args.findings_json, "r", encoding="utf-8") as f:
with open(args.context_json, "r", encoding="utf-8") as f:
return path.read_text(encoding="utf-8"), "", {"url": source, "status": None, "headers": {}, "error": None}with open(source, "r", encoding="utf-8") as fh:
with open(path, "r", encoding="utf-8") as f:
with open(html_path, "r", encoding="utf-8", errors="ignore") as f:
with open(args.query_file, "r", encoding="utf-8") as f:
with open(path, "r", encoding="utf-8") as f:
markdown = read_text(args.readme_path)
with open(args.query_file, "r", encoding="utf-8") as f:
with open(args.query_file, "r", encoding="utf-8") as f:
return path.read_text(encoding="utf-8"), "", {"url": source, "status": None, "headers": {}, "error": None}return path.read_text(encoding="utf-8"), "", {"url": source, "status": None, "headers": {}, "error": None}payload = json.loads(Path(path).read_text(encoding="utf-8"))
return open(path, "r", encoding="utf-8", errors="replace")
with open(real_path, "r", encoding="utf-8") as f:
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
with open(path, "w", encoding="utf-8") as f:
with open(args.output, "w", encoding="utf-8") as f:
os.unlink(html_path)
with open(path, "w", encoding="utf-8") as f:
with open(args.output, "w", encoding="utf-8") as f:
with open(args.output, "w", encoding="utf-8") as f:
with open(args.output, "w", encoding="utf-8") as f:
with open(args.output, "w", encoding="utf-8") as f:
with open(args.output, "w", encoding="utf-8") as f:
with open(args.markdown, "w", encoding="utf-8") as f:
with open(args.action_plan, "w", encoding="utf-8") as f:
with open(args.output, "w", encoding="utf-8") as f:
with open(path, "a", encoding="utf-8") as f:
with open(path, "w", encoding="utf-8") as f:
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
from urllib.parse import urlparse
parsed = urlparse(url)
from urllib.parse import urlparse
parsed = urlparse(normalize_url(url))
import urllib.parse
f"?client=chrome&q={urllib.parse.quote(query)}"from urllib.parse import urlparse
domain = urlparse(url).netloc.replace(".", "_")from urllib.parse import urljoin, urlparse
import requests
absolute = urljoin(base_url, href)
"is_internal": urlparse(absolute).netloc == urlparse(base_url).netloc,
from urllib.parse import urlparse
return urlparse(value).scheme in ("http", "https") or ("." in value and "/" not in value)path = urlparse(url).path.lower()
from urllib.parse import urlparse
parsed = urlparse(args.url)
from urllib.parse import urlparse
page_host = urlparse(url).netloc if url else ""
host = urlparse(link.get("href", "")).netlocfrom urllib.parse import parse_qs, urlparse
params = parse_qs(urlparse(url).query)
href_params = parse_qs(urlparse(tag.get("href")).query)from urllib.parse import urlparse, urljoin
parsed = urlparse(site_url)
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (3 occurrence(s) shown as evidence).
pip install google-api-python-client google-auth-oauthlib
print("Error: google-api-python-client and google-auth-oauthlib required.", file=sys.stderr)print("Install with: pip install google-api-python-client google-auth-oauthlib", file=sys.stderr)Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →