Skip to content

v0.4.0 — Two New Skills + Consulting CTA

Choose a tag to compare

View all tags
@maxschottke-spec maxschottke-spec released this 22 May 15:35
· 35 commits to main since this release
v0.4.0
2e36757
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Minor version: two new skills (ai-citations-tracker, gsc-deep-dive) + a maintainer-consulting CTA in the README. No breaking changes — existing v0.3.x installs upgrade transparently. Install:

```
/plugin marketplace add maxschottke-spec/seo-survival-kit#v0.4.0
```

What's new

`ai-citations-tracker` — the leading-indicator measurement loop

The companion to `ai-search-rescue`: while that skill is the framework, this one is the weekly cron that measures. Fires a configurable brand-mention prompt set against ChatGPT (OpenAI API) + Perplexity (Sonar API), parses each answer for brand vs competitor mentions, appends NDJSON history for trend analysis.

  • Same architecture as `psi-weekly-cron-baseline` (config → fetch → NDJSON → cron)
  • Cost: ~$0.10/year of OpenAI credits + Perplexity free tier
  • Manual workflow documented for Google AI Mode / AI Overviews / Bing Copilot / Claude.ai (no stable public APIs yet)

Why it matters: the LESSONS.md observation that AI citations move 2–6 weeks before classical Sistrix VI recovers makes this the most actionable leading indicator for recovery work. Most plugins describe AI search visibility — this one measures it.

`gsc-deep-dive` — removes the daily-friction point

One-call Google Search Console snapshot. Pulls top queries, top pages, query-page pairs, search-appearance breakdown (incl. AI Overview impressions where GSC exposes them), and derives a summary with Quick-Win opportunity counts (positions 11–20 with >100 impressions).

  • Authenticates via service-account JWT — manual RS256 sign via Node crypto, no `googleapis` npm dep (keeps the zero-runtime-deps discipline)
  • 15-20 min one-time GCP setup (create service account, grant GSC restricted access)
  • Free; well within GSC API quota for one site weekly
  • Removes the manual GSC click-through that is the friction point of every recovery / audit session

`README` "Need help running this on your own site?" section

Three explicit consulting offerings between the Contributors and Status sections:

  • Recovery Audit (fixed-fee) — diagnose PDF + 60-min strategy call + 4-phase plan
  • Recovery Begleitung (3-6 month retainer) — monthly reviews + plan adjustments
  • Outreach pipeline setup — for agencies that want decision-maker-ready PDFs

Optional and explicit about that. Plugin works fine without engagement.

Security

Both new scripts follow every post-Round-1-audit hardening convention (v0.3.2 H1-H4 + M1-M6 + L2/L3/L5/L7):

  • API keys env-only (`OPENAI_API_KEY`, `PERPLEXITY_API_KEY`, `GSC_SERVICE_ACCOUNT_JSON`); hard-fail if config has key field
  • Validate-at-load + trust-at-use for every config input
  • Hardcoded network destinations only — `api.openai.com`, `api.perplexity.ai`, `oauth2.googleapis.com`, `searchconsole.googleapis.com`, `www.googleapis.com/pagespeedonline/v5`. No SSRF possible
  • 12-pattern `sanitize()` on every AI-surface response and every GSC query string (Google indexes attacker-controllable search strings)
  • NDJSON / JSON output files `chmod 0o600` on first write
  • Symlink-clobber defense on the GSC snapshot output path

Compatibility

No breaking changes vs v0.3.x. Existing installs keep working. The two new skills are opt-in — install + ignore them if you don't need AI-citation tracking or direct GSC access. The README consulting section is purely additive.

See CHANGELOG.md for the full breakdown.

Assets 2
Loading