Use when a store has missing SEO titles or meta descriptions and you want to backfill them: "backfill missing SEO titles/descriptions", "meta description sweep", "SEO meta backfill across products/collections/pages/blog posts", "missing pag…
What we found · 7
Bloated: high token costmedium~2,366 tokens on every single call. Compress instructions and trim examples.
References API keys / env configmediumReads an API key or env var — normal for API clients. Ensure keys come from the runtime (not hardcoded); a leak risk only if sent to an untrusted endpoint.
Contains curl / wget network commandmediumAccesses the network from the shell. If the target is untrusted it can pull malware or exfiltrate data.
Reads credentials and makes network calls — verify the destinationmediumThe normal shape of an API client (your key → the API). Static analysis sees the capability, not the intent — confirm the endpoint is one you trust; it is a data-leak risk only if it is not.
Description too longlowThe description is read on every trigger check; overly long ones waste tokens and dilute the signal.
Repeated contentlow~3 duplicate lines detected; de-duping is free token savings.
Embedded shell script block — in a warninglowAppears inside a prohibition/warning ("never …"), not as an instruction to run. Flagged for awareness only.
What its scripts can do
high
Reads secrets
medium
Network egress
Have you installed shopify-seo-metadata? Scan everything you run.
One command grades every skill in your Claude Code / Codex — safety, token bloat, and conflicts, 100% locally.
Independent static analysis by SkillMOO — the Consumer Reports for agent skills. Safety, token, and conflict grades are computed, not opinions. Efficacy is only ever claimed when measured. We rate & link to the source; we do not rehost skill content.