Skip to content

v0.3.3 — Polish-Pass (L-severity hardening)

Choose a tag to compare

View all tags
@maxschottke-spec maxschottke-spec released this 22 May 14:35
· 37 commits to main since this release
v0.3.3
4f19b0b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release. Non-functional hardening of code that already worked correctly under normal use. Existing v0.3.2 installs upgrade transparently — no skill behavior changes, no trigger-phrase changes, no plugin-manifest surface changes.

```
/plugin marketplace add maxschottke-spec/seo-survival-kit#v0.3.3
```

Closes the LOW-severity findings (L2, L3, L5, L7, N2) from the 2026-05-22 Round 1 external audit. See CHANGELOG.md for the per-item explanation.

# File Fix
L2 `lib/safe.js` Cross-platform note about `fs.chmodSync` no-op on NTFS
L3 `psi-fetch.example.js` NDJSON history file `chmod 0o600` on first write (was world-readable via default umask)
L5 `seo-report-gen.js` Symlink-clobber defense on PDF output path
L7 `competitor-deep-audit.example.js`, `seo-onpage.js` CR/LF strip + length cap on scraped strings before stderr logging
N2 `seo-audit-free/SKILL.md` Security note about `/tmp/` writes on shared hosts + `mktemp -d` pattern
Assets 2
Loading