Seo Playbook Optimizer

SEO + GEO content optimizer based on proven internal SOP playbook. Input a URL or keyword + page content, outputs a full SEO audit: keyword matrix, Title Tag...

What to check before installing or running this skill: - Missing dependency transparency: The script calls `openclaw agent` and `python3` but the skill metadata lists no required binaries or credentials. Verify whether your environment has an `openclaw` CLI and what account/model it will use; if you don't control that, do not run the script with sensitive content. - Data exfiltration risk: analyze.sh sends the page content and prompt to an agent. Any content you pass (including private page text, internal URLs, or competitor data) will be transmitted to whatever model/back-end the CLI uses. Only run it if you understand and trust that endpoint and its privacy/security model. - SEO policy/ethics: The SOP recommends tactics that can skirt search-engine disclosure (e.g., avoiding rel='sponsored'/'ugc', 'pillow links', forum/Quora link quotas). Those can violate search engine guidelines and could harm your site. Treat backlink/guest-post recommendations with caution and consult your legal/SEO policy advisor. - Verify the upstream project and author: The homepage points to a GitHub repo — inspect that repo, check commits, issues, and author reputation. Confirm the registry owner identity if you need accountability. - Safe testing: If you want to try it, run the script in an isolated environment with example/non-sensitive content, and monitor network calls (so you can see where data goes). Prefer manual prompt usage in a controlled client you trust rather than blind execution. If you want, I can: - show the exact lines in analyze.sh that call external tools and what variables would be transmitted, or - suggest a safer wrapper that logs where data would be sent before executing.

Type: OpenClaw Skill Name: seo-playbook-optimizer Version: 1.2.0 The skill bundle provides a comprehensive SEO and GEO optimization tool, but it contains a prompt injection vulnerability in `analyze.sh`. User-provided inputs (keyword, content, and URL) are directly interpolated into a large AI prompt without sanitization, which could allow an attacker to override the internal SOP rules or manipulate the agent's behavior. While the code logic is aligned with the stated SEO purpose and no evidence of intentional malice (such as data exfiltration or backdoors) was found, the vulnerability warrants a suspicious classification.