Build comprehensive GEO performance reports with executive summaries, platform breakdowns, competitive analysis, and strategic action plans. Use whenever the...
Security Analysis
medium confidenceThe package is not malicious, but the implementation and instructions are inconsistent with the ambitious description — it overpromises and contains input-schema mismatches and provenance gaps that make its behavior unclear.
The skill description promises a comprehensive, 5-section GEO performance report with platform breakdowns, competitive analysis, narratives, and action plans. The included script is very small and only emits a short markdown report using a few top-level fields (aigvr, mentions, som, sentiment, chatgpt, perplexity). The SKILL.md examples show nested 'platforms' objects and fields like 'aigvr_change' and competitor arrays that the script does not parse. This is an overpromise / capability mismatch: the files do not implement the full described functionality.
Runtime instructions are narrow and explicit: run the provided Python script against a local JSON file. The instructions do not attempt to read arbitrary system files, environment variables, or call external endpoints. However, SKILL.md contains a broad trigger line ('Use whenever the user mentions...') which could cause the agent to run this skill automatically in many contexts — combined with the capability mismatch, that could produce misleading outputs when invoked autonomously.
No install spec and no network downloads; this is an instruction-only skill with one small local script. Nothing is written to disk by an installer or fetched from external URLs during installation.
The skill requests no environment variables, no credentials, and no config paths. The script operates only on a user-supplied local JSON file. There is no obvious request for secrets or unrelated credentials.
always is false and the skill does not request persistent system privileges. It can be autonomously invoked by the agent (default platform behavior), which is normal; consider the broad trigger in the SKILL.md when deciding whether to enable autonomous invocation.
Guidance
This skill is not hostile, but it appears to overpromise and is incomplete. Before installing or relying on it: 1) Note provenance: source is unknown and there is no homepage—treat it as unvetted. 2) Test locally with representative JSON: the included script expects top-level keys like 'chatgpt' and 'perplexity', but SKILL.md shows a nested 'platforms' object and competitor arrays; adapt the script or reshape your input so fields match. 3) The SKILL.md examples use '+5' style annotations which are not valid JSON—ensure your metrics file uses plain numbers. 4) If you plan to allow autonomous invocation, be aware the trigger wording is broad and the script can produce incomplete/misleading reports when run automatically. 5) If you need the full advertised functionality (competitive narratives, platform-level detail), either extend the script yourself or get a version from a verifiable source. If you're unsure, run the code in a sandboxed environment and inspect/modify the script before use.
Latest Release
v1.0.0
Initial release: Build structured GEO performance reports from raw metrics, GEOly AI report template
Popular Skills
Published by @geoly-geo on ClawHub
