Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PavloSEO/seohead-seotools --skill security-auditgit clone --depth 1 https://github.com/PavloSEO/seohead-seotoolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pavloseo/seohead-seotools/security-audit)<a href="https://agentmods.dev/skills/pavloseo/seohead-seotools/security-audit"><img src="https://agentmods.dev/badge/skills/pavloseo/seohead-seotools/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pavloseo/seohead-seotools/security-audit"><img src="https://agentmods.dev/badge/skills/pavloseo/seohead-seotools/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00180 | $0.00885 |
| Opus 5 | $0.00090 | $0.00443 |
| Sonnet 5 | $0.00036 | $0.00177 |
| Haiku 4.5 | $0.00018 | $0.00089 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit — security headers and information disclosure
This is not a penetration test. Everything uses ordinary GET requests for information the site
already serves publicly: response headers, cookie flags, and the HTTPS redirect. Nothing is
modified and no values are guessed. This matters for SEO: HSTS and HTTPS affect trust and
rankings, while an exposed .git or .env directly enables data leakage and a subsequent
compromise that may damage search visibility.
The tool is seohead security-check (CLI + MCP seo_security_check + HTTP).
When to use it
- "check site security," "security headers," "security score";
- "is HSTS / CSP present," "are the headers configured";
- "does the server / PHP version leak";
- "is .git / .env blocked," "is phpinfo publicly exposed";
- before delivering a site to a client or as part of a full audit.
Workflow
Baseline check (safe and makes no unnecessary requests):
seohead security-check --url https://example.com
The response contains score and grade (A–F based on the weighted total),
headers_present, headers_missing (with the purpose of each header),
version_disclosure (what discloses version information), cookies (the
Secure/HttpOnly/SameSite flags for each cookie), https_redirect (whether HTTP redirects
to HTTPS), and findings, a list of issues in plain language.
Probe operational paths (only when the user explicitly requests it):
seohead security-check --url https://example.com --probe-paths
This additionally checks whether /.git/HEAD, /.env, /.DS_Store, /.svn/entries,
/phpinfo.php, /server-status, or /backup.sql is publicly accessible. The tool uses
content inspection to distinguish a genuinely exposed file from a soft 404. This is still
limited to reading public URLs, but enable the flag only when the user asks to check for
information disclosure, not by default.
Score (grade)
A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, E ≥ 20; otherwise F. HSTS and CSP are weighted at 20 points
each, and the other four headers at 15 points each. X-Frame-Options counts as present if its
role is covered by frame-ancestors in CSP.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 69 lines · 180 tokens per session scan A 26d7814d4fcb
security-audit is a skill published in the GitHub repository PavloSEO/seohead-seotools (0 stars, last pushed 5d ago), licensed MIT. It adds 180 tokens to every session and 885 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fire-your-seo-agency
A procedure for improving how a website appears in search engines and how AI answer systems find and cite it. It covers search, answer-engine, generative-AI, and Naver visibility.
geo-loop
Run one bounded eGEOagents loop iteration over a workspace domain - read the charter and fresh collector data, do ONE unit of work, write substrate artifacts, append one Timeline entry and one LOG line. Use for loop mode, /geo:loop, scheduled GEO runs, or continuous monitoring.
competitive-analysis
Analyze AI-search competitors for a query and recommend ranking strategy. Use when users ask competitor analysis, who ranks, or competitive landscape.
content-scoring
Score content against the 10 GEO criteria with evidence and prioritized fixes. Use when users ask to score, rate, evaluate, or estimate ranking strength.
validation-doctor
Check Brave Search and Chrome DevTools MCP availability and provide exact setup snippets. Use when validation dependencies are missing or uncertain.
geo-content-research
Researches what prompts people ask AI engines (ChatGPT, Gemini, Perplexity, Claude) about a product category and produces a prompts.csv artifact — a prioritized, strictly-schema'd list of the queries where the brand should be cited. Feeds the monitor workflow.