Evaluate the 8 exec-scope skills in AgriciDaniel/claude-seo, where the install registers a hook on every Edit and Write in every session #1100

New issue

Open

opened 2026-08-16 06:53:15 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-16 06:53:15 +00:00

Member

Source

Upstream: https://github.com/AgriciDaniel/claude-seo, directory skills/. MIT, user-owned, created 2026-02-07, last pushed 2026-08-16, the same day as this evaluation. 14,243 stars, 2,072 forks, 40 open issues.

25 skills and 18 sub-agents confirmed by clone. Companion issue covers the Content Creator-scope subset, which is the large majority of them.

Scope

8 of 25 fall in Executive Strategist scope, judged against the generic exec charter of deciding where to invest attention across a portfolio.

The other 17 are content production, schema authoring, image generation, and on-page optimization. Those are Content Creator work and are not assessed here.

The finding that matters

Installing this registers a hook that runs on every Edit and Write tool call, in every session, whether or not any SEO skill is in play.

hooks/hooks.json:

"PostToolUse": [{
  "matcher": "Edit|Write",
  "hooks": [{ "type": "command", "command": "node",
    "args": ["${CLAUDE_PLUGIN_ROOT}/hooks/run-python-hook.js",
             "${CLAUDE_PLUGIN_ROOT}/hooks/validate-schema.py",
             "${tool_input.file_path}"] }]
}]

Every file this estate edits would spawn a Node process, which spawns a Python process, receiving the edited file path. That is not scoped to SEO work, not opt-in per skill, and not visible from reading any individual SKILL.md.

This is a materially larger blast radius than the previously evaluated Varnan-Tech/opendirectory, which shipped no hooks at all. The correct comparison is not skill-to-skill. One repo offers documents, this one offers documents plus a persistent execution surface.

Candidate set, ranked by generic-exec value

seo-drift - the strongest fit. Baseline, compare, and history over SEO-critical page elements, with 17 comparison rules across 3 severity levels and SHA-256 content hashing. Framed as "git for your SEO". It answers "did the thing we shipped stay shipped", which is measurement rather than production.
seo-audit - portfolio self-assessment producing a 0-100 health score. Structurally the same shape as dx-roaster from the opendirectory evaluation, and the same reason to care.
seo-google - Search Console, GA4, and CrUX field data. The only skill in the set that reads real measured outcomes rather than inferring them.
seo-competitor-pages - competitive read against named competitor URLs.
seo-cluster - semantic clustering, which is demand structure rather than content.
seo-plan - planning and sequencing.
seo-dataforseo - external market data through a paid vendor.
seo-maps - local market intelligence via geo-grid rank tracking.

What was actually verified

Cloned and audited rather than read from the README. Verified by grep and direct file reads across all 25 skills:

Credentials referenced: GOOGLE_API_KEY (12 references), MOZ_API_KEY (4), DATAFORSEO_PASSWORD (4), INDEXNOW_KEY (3).
No backend-direct LLM calls. Gemini is reached through an MCP tool rather than a curl to generativelanguage.googleapis.com. This is architecturally better than opendirectory, where 13 references hit that endpoint directly, and it means the Agent Proxy transport rule is not violated by construction.
Skill sizes run 4,019 to 17,227 characters. Every one of the 8 exceeds the 4,000-character documentation band this estate enforces, so none could land unsplit.
seo-audit crawls up to 500 pages and delegates to as many as 15 subagents.
External data sources include overpass-api.de and nominatim.openstreetmap.org, both of which carry usage policies that a 500-page crawl could breach.

Two of the eight were read in full, seo-drift and seo-audit. The rest are frontmatter and grep level.

Known blockers

The Edit|Write hook, above. This is the one that decides the answer.
DATAFORSEO_PASSWORD is a plaintext account password in an env var, the same pattern flagged on show-hn-writer in #1078. A vendor password differs from an API key in that it is usually not scoped and not independently revocable.
The documented install path carries a paid-membership upsell. The README instructs Pro members of a paid community to swap the repository and plugin slug for an early-access variant, with "DM in the Skool community to get added" if the marketplace add 404s. The open-source repository is the funnel's free tier. That is not disqualifying, but it means upstream direction is set by a commercial interest rather than by the OSS contributors.
/plugin marketplace add writes outside the canonical agent-compose and mcporter projection, the same placement objection recorded in #1078.

The exec read, and it is unfavourable

This is a well-built repo for a problem Kai does not have.

The 8 skills above measure organic search performance across a content property. Kai has one personal site and no content business. Organic search position is not a metric in the coilysiren/inbox#283 career program, and lore-credential-legibility records that the live audience problem is practitioners versus technical buyers, which SEO addresses for neither.

seo-drift is genuinely the best-designed measurement skill either repo has produced, and the pattern is worth reading even though the subject is wrong. Baseline, hash, diff against stored state, and grade the delta by severity is a shape that generalizes to any artifact worth watching for regression.

Acceptance criteria

Decide on the hook first, before reading any further skills. If a persistent Edit|Write hook is unacceptable, the whole repository is out and steps 2 onward are wasted work.
If it proceeds, confirm whether the hook can be excluded while retaining skills, and whether that survives an upstream update.
Read the remaining 6 in full, including references/ and any credential surface.
For each, name the data source, whether the access pattern respects that source's terms, and whether the metric it produces appears anywhere in #283.
Reauthor rather than install. No /plugin marketplace add, no install.sh. Every skill exceeds the 4,000-character band and would need splitting regardless.
Anything adopted must name which existing decision surface consumes its output, per the rule established in #1078.

#1077 and #1078 cover the Varnan-Tech/opendirectory evaluation, parked against the coilysiren/inbox#283 portfolio freeze. The same freeze applies here. This issue records the assessment so it is not re-run, and does not propose adoption while that constraint stands.

## Source Upstream: https://github.com/AgriciDaniel/claude-seo, directory `skills/`. MIT, user-owned, created 2026-02-07, **last pushed 2026-08-16, the same day as this evaluation.** 14,243 stars, 2,072 forks, 40 open issues. 25 skills and 18 sub-agents confirmed by clone. Companion issue covers the Content Creator-scope subset, which is the large majority of them. ## Scope 8 of 25 fall in Executive Strategist scope, judged against the generic exec charter of deciding where to invest attention across a portfolio. The other 17 are content production, schema authoring, image generation, and on-page optimization. Those are Content Creator work and are not assessed here. ## The finding that matters **Installing this registers a hook that runs on every `Edit` and `Write` tool call, in every session, whether or not any SEO skill is in play.** `hooks/hooks.json`: ```json "PostToolUse": [{ "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": "node", "args": ["${CLAUDE_PLUGIN_ROOT}/hooks/run-python-hook.js", "${CLAUDE_PLUGIN_ROOT}/hooks/validate-schema.py", "${tool_input.file_path}"] }] }] ``` Every file this estate edits would spawn a Node process, which spawns a Python process, receiving the edited file path. That is not scoped to SEO work, not opt-in per skill, and not visible from reading any individual `SKILL.md`. This is a materially larger blast radius than the previously evaluated `Varnan-Tech/opendirectory`, which shipped no hooks at all. **The correct comparison is not skill-to-skill. One repo offers documents, this one offers documents plus a persistent execution surface.** ## Candidate set, ranked by generic-exec value * `seo-drift` - **the strongest fit.** Baseline, compare, and history over SEO-critical page elements, with 17 comparison rules across 3 severity levels and SHA-256 content hashing. Framed as "git for your SEO". It answers "did the thing we shipped stay shipped", which is measurement rather than production. * `seo-audit` - portfolio self-assessment producing a 0-100 health score. Structurally the same shape as `dx-roaster` from the opendirectory evaluation, and the same reason to care. * `seo-google` - Search Console, GA4, and CrUX field data. The only skill in the set that reads real measured outcomes rather than inferring them. * `seo-competitor-pages` - competitive read against named competitor URLs. * `seo-cluster` - semantic clustering, which is demand structure rather than content. * `seo-plan` - planning and sequencing. * `seo-dataforseo` - external market data through a paid vendor. * `seo-maps` - local market intelligence via geo-grid rank tracking. ## What was actually verified Cloned and audited rather than read from the README. Verified by grep and direct file reads across all 25 skills: * **Credentials referenced:** `GOOGLE_API_KEY` (12 references), `MOZ_API_KEY` (4), `DATAFORSEO_PASSWORD` (4), `INDEXNOW_KEY` (3). * **No backend-direct LLM calls.** Gemini is reached through an MCP tool rather than a curl to `generativelanguage.googleapis.com`. **This is architecturally better than opendirectory**, where 13 references hit that endpoint directly, and it means the Agent Proxy transport rule is not violated by construction. * **Skill sizes run 4,019 to 17,227 characters.** Every one of the 8 exceeds the 4,000-character documentation band this estate enforces, so none could land unsplit. * `seo-audit` **crawls up to 500 pages and delegates to as many as 15 subagents.** * External data sources include `overpass-api.de` and `nominatim.openstreetmap.org`, both of which carry usage policies that a 500-page crawl could breach. Two of the eight were read in full, `seo-drift` and `seo-audit`. The rest are frontmatter and grep level. ## Known blockers 1. **The `Edit|Write` hook**, above. This is the one that decides the answer. 2. **`DATAFORSEO_PASSWORD` is a plaintext account password in an env var**, the same pattern flagged on `show-hn-writer` in `#1078`. A vendor password differs from an API key in that it is usually not scoped and not independently revocable. 3. **The documented install path carries a paid-membership upsell.** The README instructs Pro members of a paid community to swap the repository and plugin slug for an early-access variant, with "DM in the Skool community to get added" if the marketplace add 404s. The open-source repository is the funnel's free tier. That is not disqualifying, but it means upstream direction is set by a commercial interest rather than by the OSS contributors. 4. **`/plugin marketplace add` writes outside the canonical agent-compose and mcporter projection**, the same placement objection recorded in `#1078`. ## The exec read, and it is unfavourable **This is a well-built repo for a problem Kai does not have.** The 8 skills above measure organic search performance across a content property. Kai has one personal site and no content business. Organic search position is not a metric in the `coilysiren/inbox#283` career program, and `lore-credential-legibility` records that the live audience problem is practitioners versus technical buyers, which SEO addresses for neither. `seo-drift` is genuinely the best-designed measurement skill either repo has produced, and **the pattern is worth reading even though the subject is wrong.** Baseline, hash, diff against stored state, and grade the delta by severity is a shape that generalizes to any artifact worth watching for regression. ## Acceptance criteria 1. **Decide on the hook first, before reading any further skills.** If a persistent `Edit|Write` hook is unacceptable, the whole repository is out and steps 2 onward are wasted work. 2. If it proceeds, confirm whether the hook can be excluded while retaining skills, and whether that survives an upstream update. 3. Read the remaining 6 in full, including `references/` and any credential surface. 4. For each, name the data source, whether the access pattern respects that source's terms, and whether the metric it produces appears anywhere in `#283`. 5. Reauthor rather than install. No `/plugin marketplace add`, no `install.sh`. Every skill exceeds the 4,000-character band and would need splitting regardless. 6. Anything adopted must name which existing decision surface consumes its output, per the rule established in `#1078`. ## Related `#1077` and `#1078` cover the `Varnan-Tech/opendirectory` evaluation, parked against the `coilysiren/inbox#283` portfolio freeze. **The same freeze applies here.** This issue records the assessment so it is not re-run, and does not propose adoption while that constraint stands.

coilyco-ops added the

labels

2026-08-17 02:36:37 +00:00