{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "geo-seo-claude",
  "built": "2026-10-26",
  "control_level": 4,
  "control_level_label": "L4 高权限",
  "capabilities": [
    "execute_command",
    "install_deps",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "sandbox_recommended",
      "graded_authorization"
    ],
    "admin": [
      "approval_process",
      "rollback_support",
      "full_audit"
    ]
  },
  "evidence": [
    {
      "file": "scripts/",
      "summary": "Executes local scripts or commands: During installation (explicitly run by user): install.sh / install-win.sh creates directories, copies geo/, skills/*, agents/*, s"
    },
    {
      "file": "scripts/ 或 SKILL.md",
      "summary": "Declares dynamic installation of external language package dependencies"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: Audited targets themselves: requests.get in scripts/*.py targets user-supplied http/https URLs (fetch_page explicitly rejects non-HTTP)"
    },
    {
      "file": "本地工作目录",
      "summary": "File read/write and artifact output: Audit artifacts are written to the current working directory: GEO-AUDIT-REPORT.md, GEO-PAGE-ANALYSIS.md, GEO-CITABILITY-SCORE."
    }
  ],
  "verification": {
    "method": "第二遍独立重读 + 反查（换角度抓第一遍的错）：① 用 `git ls-tree -r HEAD --name-only` 取全量 71 个受管文件做资产面清单（核对 scripts/、schema/、templates/、agents/、skills/、white-box 白标、tests、docs、examples），确认无二进制、无编码载荷、无未列出的隐藏脚本（hooks/ 目录实际不存在）；② 对 scripts/*.py、*.sh、*.md、templates/* 逐类 token 扫描（requests/urllib/urlopen/os.environ/getenv/GITHUB_TOKEN/api_key/curl/wget/git clone/pip install/rm -rf、以及全部 http(s) 域名），逐条落到调用点，得到『网络目标 + 凭证读取 + 写盘』三张实证表；③ 逐条复核每个 external_dep 的真实调用点（requests→fetch_page/brand_scanner/llmstxt_generator/citability_scorer 四处 requests.get；flask→webapp/app.py import；rich→crm_dashboard import；pandoc/Chrome→geo-report-pdf 命令行；git→install/update 与 README 一键安装；字体/CDN→CSS @import 与 base.html）；④ 功能声明 vs 实际能力对账，专抓夸大：品牌提及『扫描 10+ 平台』实为 2 个真 API + 其余交办，PDF『with charts』实为 CSS 色块 + 内联 JS 上色，README/docs 仍指 scripts/generate_pdf_report.py + ReportLab（该文件不存在），子技能数量三处不一致；⑤ 用 `git rev-parse HEAD` 确认本地工作副本 == pin 25f6ae8d，并读 LICENSE 确认 MIT（Copyright (c) 2026 Zubair Trabzada）；⑥ 安装器隔离性口径核对：install.sh 确为专属 venv + shebang 重写，install-win.sh 则 pip install --user。",
    "second_pass": [
      {
        "item": "skill.path 定位",
        "status": "ok",
        "detail": "候选位置逐一排查：仓库根无 SKILL.md（git ls-tree 确认根目录只有 README/LICENSE/install*/uninstall/requirements 与各功能目录）；`geo/SKILL.md` 是唯一带 `name: geo` 的路由入口，frontmatter 声明 17 条 /geo 命令并提供 sub-skill/agent 分工表；install.sh 把 `geo/` 装成 ~/.claude/skills/geo 并把 `$INSTALL_DIR/SKILL.md` 当作主技能文件（`INSTALL_DIR=\"${SKILLS_DIR}/geo\"`），geo-update 亦称 Main skill = ~/.claude/skills/geo/；docs/architecture.md 与 README 同称 'geo/ # Main skill orchestrator'。skills/* 是子技能（无 flagship 地位，安装时被平铺到 ~/.claude/skills/geo-*）。故取 skill.path=\"geo\"——仓库根不是 skill，子技能目录是下级组件。"
      },
      {
        "item": "README/docs 的 PDF 实现描述（generate_pdf_report.py + ReportLab）",
        "status": "discrepancy",
        "detail": "README 架构图写 '│   ├── generate_pdf_report.py    # PDF report generator (ReportLab)'，docs/commands-reference.md 写 '- Calls `python3 ~/.claude/skills/geo/scripts/generate_pdf_report.py` (requires `pip install reportlab`).'；但 71 个受管文件中并无该脚本，requirements.txt 没有 reportlab，现行 skills/geo-report-pdf/SKILL.md（version 2.0.0）明确 'No Python dependencies. No ReportLab.'，改用 pandoc + Chrome headless + 仓内模板/CSS。结论：README 与 commands-reference 是未同步的旧文档，应以 geo-report-pdf v2.0.0 为准。"
      },
      {
        "item": "子技能数量与实际目录数",
        "status": "discrepancy",
        "detail": "三处口径互斥：README '├── skills/ # 13 specialized sub-skills'、docs/architecture.md 同写 13；geo/SKILL.md 标题 '## Sub-Skills (14 Specialized Components)' 且表格缺 geo-report-pdf；实际 `skills/` 下有 15 个目录（含 geo-report-pdf）。另外 router 命令表共 17 条命令，其中 `/geo page` 与 `/geo quick` 没有对应子技能目录（由其它技能组合实现）。用户按文档理解能力边界会有偏差。"
      },
      {
        "item": "品牌提及『扫描 10+ 平台』的夸大检查",
        "status": "discrepancy",
        "detail": "README 称 'Scans YouTube, Reddit, Wikipedia, LinkedIn, and 7+ other platforms'。实读 scripts/brand_scanner.py：只有 Wikipedia API 与 Wikidata API 两处 requests.get 是真实网络判定；YouTube/Reddit/LinkedIn/Quora/Stack Overflow/GitHub/Crunchbase/Product Hunt/G2/Trustpilot 分支仅返回 search_url + check_instructions，并由代码注释明示 'Actual YouTube API would be used in production / This provides the framework for Claude Code to use WebFetch'。属能力边界夸大（真实核查转由 agent 的 WebFetch/搜索完成）。"
      },
      {
        "item": "安装器『隔离 venv、不动系统 Python』承诺",
        "status": "discrepancy",
        "detail": "README 声明 'Python dependencies are installed into a dedicated virtual environment at `~/.claude/skills/geo/.venv/`. Your system Python is **not** touched'，install.sh 确实如此（venv + `uv pip install --python \"$VENV_PY\"`/`$VENV_PY -m pip install` + 把脚本 shebang 与 SKILL.md 中 python3 调用 sed 成 venv 解释器）。但 install-win.sh 走的是 `$PYTHON_CMD -m pip install --user -r \"$SOURCE_DIR/requirements.txt\"`（写用户级 site-packages），与承诺不符；/geo update 也用 `python3 -m pip install -r ...`（非 venv 路径）。"
      },
      {
        "item": "hooks 安装路径",
        "status": "ok",
        "detail": "两个安装器都 `mkdir -p \"$INSTALL_DIR/scripts\" \"$INSTALL_DIR/schema\" \"$INSTALL_DIR/hooks\"` 并在 `[ -d \"$SOURCE_DIR/hooks\" ]` 守卫下复制 hooks；仓库内确无 hooks/ 目录（本地 ls 报 No such file or directory，git ls-tree 亦无），故该分支在源码态为惰性空操作，不构成未列出的执行面。"
      },
      {
        "item": "全部 external_deps 二次定位",
        "status": "ok",
        "detail": "18 条依赖逐条回到调用点复核：requests 在 fetch_page.py/citability_scorer.py/brand_scanner.py/llmstxt_generator.py 四处 requests.get；beautifulsoup4+lxml 在 fetch_page/llmstxt 的 BeautifulSoup(..., \"lxml\")；flask 在 webapp/app.py 顶层 import 且 `app.run(debug=debug, port=5050)`；rich 在 crm_dashboard.py import 块；playwright 由 install.sh 的 venv 内 `-m playwright install chromium` 触发（requirements 亦列 playwright>=1.56.0）；pandoc/Chrome/git/uv 均为命令行调用点；Wikipedia/Wikidata/fonts.googleapis.com/jsdelivr/unpkg/api.github.com/raw.githubusercontent.com 均有原文出处。Pillow/urllib3/validators 仅见于 requirements.txt，仓内无直接调用点（已在条目 note 中标注）。"
      },
      {
        "item": "是否漏掉网络调用/隐藏脚本/混淆内容",
        "status": "ok",
        "detail": "全量 grep `requests\\.|urllib|urlopen|getenv|environ|api_key|API_KEY|token|Authorization|https?://` 无遗漏命中：除已列条目外只剩示例/文档里的 schema.org、w3.org 等纯参考资料 URL，无上传/回传/统计端点；全文无 base64 长串、无 eval/exec、无 subprocess 拼装执行远端内容（webapp 与 crm_dashboard 只读写本地 JSON）。资产面 71 文件全部为文本，无二进制/压缩包。"
      },
      {
        "item": "脚本写盘与 allowed-tools 的关系",
        "status": "ok",
        "detail": "复核发现 5 个 Python 脚本本身几乎不写文件（除 webapp/app.py 的 save_prospects 写 ~/.geo-prospects/prospects.json 之外，其余只 print JSON），报告落盘实际由 agent 的 Write 工具完成——与各 SKILL.md 声明的 allowed-tools（Read/Grep/Glob/Bash/WebFetch/Write）一致；Bash 的用途是让 venv 内的脚本可执行，属声明式而非隐蔽。"
      },
      {
        "item": "pin 与 license",
        "status": "ok",
        "detail": "`git -C spy-repos/geo-seo-claude rev-parse HEAD` 输出 25f6ae8d6c96743701222d6d9214267fbf039bb4，与任务给定 pin 完全一致；LICENSE 为 MIT（'MIT License' + 'Copyright (c) 2026 Zubair Trabzada'），README '## License / MIT License' 与之一致。"
      },
      {
        "item": "meta.stars / meta.last_push 复核",
        "status": "unlocatable",
        "detail": "stars=10614 与 last_push=2026-09-15 采用任务给定池内值；本地只读工作副本无法离线验证 GitHub 计数与推送时间（第二遍未执行任何网络查询，亦未调用 gh API），故不声称已复核，仅在元数据中原样引用。"
      },
      {
        "item": "CI 凭证读取是否应计入安全面",
        "status": "ok",
        "detail": ".github/scripts/star_history.py 用 `TOKEN = os.environ.get(\"GITHUB_TOKEN\", \"\")` 调 api.github.com 的 stargazers，并由 .github/workflows/star-history.yml 以 `${{ secrets.GITHUB_TOKEN }}` 注入，属仓库 CI（GitHub Actions 内置令牌，权限 contents: write）；该脚本不随安装进入 ~/.claude，亦不被任何 SKILL.md 调用，故不计入 skill 的 credential_reads，但已在 network_calls/scripts_executed 中透明列出。"
      }
    ],
    "level": 1,
    "level_label": "V1 已固定",
    "commit": "25f6ae8d6c96743701222d6d9214267fbf039bb4",
    "sha256": "3a969f95e983e9c40d742e64d11c2b067a601b20560a82f1f800036b7859fb85",
    "reviewed_by": null,
    "reviewed_at": null
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-15/geo-seo-claude.tar.gz",
    "sha256": "3a969f95e983e9c40d742e64d11c2b067a601b20560a82f1f800036b7859fb85",
    "commit": "25f6ae8d6c96743701222d6d9214267fbf039bb4"
  },
  "original": {
    "github": "https://github.com/zubair-trabzada/geo-seo-claude/tree/main/geo",
    "path": "geo",
    "commit": "25f6ae8d6c96743701222d6d9214267fbf039bb4"
  }
}