Auriti-Labs/geo-optimizer-skill

Review signals: 1 connection review, 1 download and execute, 1 hardcoded secret, 7 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 3 distinct locations. 23 attributed processes.

Source contains download and execute; review its purpose. install.sh

Gitleaks found a possible hardcoded secret; value withheld. frontend/scripts/indexnow-submit.mjs

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 7 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The README says geo audit scores a site 0-100 with prioritized fixes: Real input produced the expected result: GEO AUDIT

  Source: Run `geo audit --url https://yoursite.com` and read the priority list

  Input: https://example.com

  Expected: audit report for example.com

  Command: <guest-path> audit --url https://example.com

  Observed: GEO AUDIT — https://example.com github.com/auriti-labs/geo-optimizer-skill 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 🔍 Status: 200 | Size: 577 bytes | Duration: 623ms ============================================================ 1. ROBOTS.TXT — AI Bot Access ============================================================ ❌ robots.txt not found ============================================================ 2. LLMS.TXT — AI Index File (Other AI agents · not used by Google Search) ============================================================ ❌ llms.txt not found — essential for AI indexing!

• The README lists geo_check_bots as an MCP tool that checks bot access via robots.txt: Real input produced the expected result: example.com

  Source: | `geo_check_bots` | Check bot access via robots.txt |

  Input: {"tool": "geo_check_bots", "arguments": {"url": "https://example.com"}}

  Expected: bot access result for example.com

  Command: <guest-path> tools/call {"tool": "geo_check_bots", "arguments": {"url": "https://example.com"}}

  Observed: example.com\",\n \"robots_found\": false,\n \"citation_bots_ok\": false,\n \"bots\": {\n \"GPTBot\": {\n \"description\": \"OpenAI (ChatGPT training)\",\n \"status\": \"missing\",\n \"tier\": \"training\"\n },\n \"OAI-SearchBot\": {\n \"description\": \"OpenAI (ChatGPT search citations)\",\n \"status\": \"missing\",\n \"tier\": \"search\"\n },\n \"ChatGPT-User\": {\n \"description\": \"OpenAI (ChatGPT on-demand fetch)\",\n \"status\": \"missing\",\n \"tier\": \"user\"\n },\n \"ClaudeBot\": {\n \"description\": \"Anthropi

Examples

• Quick start one-shot audit of a site: command completed successfully

  Source: README.md Quick Start

  Input: geo audit --url https://example.com

  Expected: audit report printed

  Command: <guest-path> audit --url https://example.com

  Observed: t requires JavaScript to render (25 words in raw HTML). AI crawlers don't execute JS. Implement SSR, SSG, or pre-rendering. 💡 One-shot audit. The free plan at https://geoready.dev saves your reports and runs one real AI answer check a week; weekly score monitoring starts on Pro. → Web report for this URL (free, no account): https://geoready.dev/report/audit?url=https://example.com ⏳ Fetching page, robots.txt, llms.txt and AI files... ⏳ Analyzing schema, meta tags and content... ⏳ Checking CDN access for AI bots... ⏳ Running trust, brand and extra checks... ✅ Analysis complete.

• Contributor test suite runs offline with HTTP mocked: command completed successfully

  Source: README.md Contributing

  Input: pytest tests/ -v

  Expected: all tests pass

  Command: <guest-path> tests/ -q -p no:cacheprovider

  Observed: 's 'tmp_path' fixture with absolute paths instead. with runner.isolated_filesystem(): tests/test_v21_coverage.py::TestSchemaCmdFaqOltreTre::test_riga_198_piu_di_tre_faq_mostra_contatore <guest-path> DeprecationWarning: 'isolated_filesystem' is deprecated and will be removed in Click 9.0. Use 'tempfile.TemporaryDirectory' or pytest's 'tmp_path' fixture with absolute paths instead. with runner.isolated_filesystem(): -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html 2281 passed, 31 skipped, 8 warnings in 66.15s (0:01:06)

Local or hosted: local

Install geo-optimizer-skill from source and run the one-shot GEO audit CLI and the geo-mcp MCP server (geo_check_bots tool) against https://example.com

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && grep -n -i "install\|mcp\|--once\|schedule\|cron\|pip" README.md | head -80; python3 -c "import sys;print(sys.version)"; which uv uvx pipx; grep -n "requires-python" pyproject.toml
cd <guest-path> && sed -n 295,330p README.md; echo ----; sed -n 460,480p README.md
cd <guest-path> && python3 -m venv <guest-path> && <guest-path> install -q --upgrade pip 2>&1 | tail -3; cd <guest-path> && <guest-path> install "./[mcp]" 2>&1 | tail -5
cd /tmp && <guest-path> --version; timeout 120 <guest-path> audit --url https://example.com 2>&1 | head -40; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && grep -rn "def geo_\<email>\<email>" src | head -30; ls .coldpass; ls <guest-path> 2>&1 | head; ls /inputs 2>&1
cd <guest-path> && grep -rln "schedule\|--once\|--now\|while True\|cron" src | head; ls examples tests | head -60; cd /tmp && timeout 120 <guest-path> check-bots --help 2>&1 | head -5; <guest-path> --help 2>&1 | tail -30
cd /tmp && <guest-path> track --help 2>&1 | head -30; <guest-path> monitor --help 2>&1 | head -20; grep -n "schedule\|interval\|--once\|while" <guest-path> | head; grep -n "schedule\|--once\|--now" <guest-path> | head
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>"],"cwd":"<guest-path>","tool":"geo_check_bots","arguments":{"url":"https://example.com"},"expected_text":"example.com"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The README says geo audit scores a site 0-100 with prioritized fixes","source":"Run `geo audit --url https://yoursite.com` and read the priority list","input":"https://example.com","expected":"audit report for example.com","probe_kind":"cli","argv":["<guest-path>","audit","--url","https://example.com"],"expected_text":"GEO AUDIT","cwd":"<guest-path>"},
{"kind":"claim","claim":"The README lists geo_check_bots as an MCP tool that checks bot access via robots.txt","source":"| `geo_check_bots` | Check bot access via robots.txt |","input":"https://example.com","expected":"bot access result for example.com","probe_kind":"mcp","argv":["<guest-path>"],"tool":"geo_check_bots","arguments":{"url":"https://example.com"},"expected_text":"example.com","cwd":"<guest-path>"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (geo CLI commands audit/monitor/track/fix, geo-mcp stdio server, src/geo_optimizer/web/app.py). The README says 'The hosted platform runs the same engine on a schedule'; the local package has no cron, loop, or --once/--now scheduler. Local runs are one-shot commands.","checks":[]}
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Quick start one-shot audit of a site","source":"README.md Quick Start","input":"geo audit --url https://example.com","expected":"audit report printed","argv":["<guest-path>","audit","--url","https://example.com"],"cwd":"<guest-path>","env":{},"expected_text":"GEO AUDIT"}]
EOF
for f in *.json; do <guest-path> -m json.tool $f >/dev/null 2>&1 || python3 -I -c 'import json,sys;json.load(open(sys.argv[1]))' $f && echo "ok $f"; done; ls -la
cd /tmp && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && <guest-path> install -q -e ".[dev]" 2>&1 | tail -3; timeout 900 <guest-path> tests/ -q -p no:cacheprovider 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Quick start one-shot audit of a site","source":"README.md Quick Start","input":"geo audit --url https://example.com","expected":"audit report printed","argv":["<guest-path>","audit","--url","https://example.com"],"cwd":"<guest-path>","env":{},"expected_text":"GEO AUDIT"},
{"kind":"example","claim":"Contributor test suite runs offline with HTTP mocked","source":"README.md Contributing","input":"pytest tests/ -v","expected":"all tests pass","argv":["<guest-path>","tests/","-q","-p","no:cacheprovider"],"cwd":"<guest-path>","env":{},"expected_text":"2281 passed"}]
EOF
cat > report.json <<'EOF'
{"outcome":"working","fault_owner":"unknown","operation":"Install geo-optimizer-skill from source and run the one-shot GEO audit CLI and the geo-mcp MCP server (geo_check_bots tool) against https://example.com","operation_scope":"Linux guest, Python 3.12.3 (README requires >=3.10), venv at <guest-path>, live network access to example.com. Scheduled monitoring is hosted-only and was not exercised locally. Browser not required.","steps":["python3 -m venv <guest-path>","<guest-path> install \"./[mcp]\" (from the checkout; README: pip install \"geo-optimizer-skill[mcp]\")","<guest-path> audit --url https://example.com","<guest-path> (stdio MCP server, tool geo_check_bots)","<guest-path> install -e \".[dev]\" and pytest tests/ (README Contributing)"],"deviations":["Checker path /inputs/coldpass-preflight.py does not exist in this guest; used <guest-path> as instructed in the task.","Installed from the local checkout instead of PyPI so the pinned commit is what ran.","pip install created src/geo_optimizer_skill.egg-info in the checkout (build artifact, not product source).","No local cycle was triggered: the README's scheduling is hosted-only, so cycles.json has detected:false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c 'import json,sys;[json.load(open(f)) for f in sys.argv[1:]];print("json ok")' examples.json report.json; cd /tmp && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -I -c 'import json;d=json.load(open("<guest-path>")) if False else None' ; head -c 600 <guest-path>; echo; grep -o '"valid": [a-z]*\|"problems": \[[^]]*\]\|"status": "[A-Z]*"' <guest-path> | head -20
cd /tmp && python3 -I -c 'import json,sys;d=json.load(open(sys.argv[1]));r=d["replay"]["details"];print([ (e.get("claim"),e.get("verdict"),e.get("returncode")) for e in r.get("example_checks",[])]); print([c.get("verdict") for c in r.get("claims",[])])' <guest-path>; pgrep -fa "geo-mcp|geo " || echo "no servers running"; ls <guest-path>