OpenSEOBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ai-prompt-research
description: Find the questions people ask about a market, how ChatGPT answers them, and which sites get cited in the answers. Use when the user asks what people ask AI about their niche, wants prompt ideas, or wants to know where their brand is missing before choosing prompts to track. Research only; it never saves tracking or starts answer collection.
---

# AI Prompt Research

## Goal

Answer "What are people asking ChatGPT about my market, and who gets cited when they do?" with the questions in DataForSEO's dataset, ChatGPT's answers to them, and the sites the answers rely on. Keyword research finds what people type into Google; this finds what they ask an AI assistant.

The deliverable is a short ranked list of prompt groups worth caring about, with where the brand already appears, where it is missing, and which domains own the citations. Tracking those prompts is a separate decision the user makes in Prompt Tracking.

## Project context

The project-context tools are free and shared with the app and other agents.

1. External MCP clients: resolve the project with `list_projects`, ask only if the match is ambiguous, then call `get_project_context`. In SAM, use the current project and context already injected into the conversation; SAM has no `get_project_context` tool and needs no project selection or connection setup.
2. This workflow needs a brand, its website and a rough idea of what it sells. Reuse `business_overview`, audience, competitors and key pages. If `business_overview` is empty, infer it from the site, confirm it in one question, and save it with `update_project_context`.
3. Read `get_ai_visibility_tracker` to learn the saved topics and prompts. Prompts already tracked are marked `tracked` in research results; do not present them as new ideas. `brandMentioned` matches the tracker's own brand, whose name is the project name; if the project is not named as people write the brand, treat brand mentions as unknown and say so.
4. Check the research log for prompt research under 30 days old on the same keywords. Reuse it instead of paying again unless the user asks for fresh data.
5. On finish, append one line with `update_project_context`: `{ updates: [{ appendResearchLog: { summary: "AI prompt research: <keywords>. Verdict: <conclusion>" } }] }`.

## OpenSEO MCP tools

- `research_ai_visibility_prompts`: questions about one keyword, matched in questions and answers and kept only when a model judges they use the keyword in the business's sense (from the project's business overview), with near-duplicates merged and the most common first. Niche keywords may return few prompts. Each prompt has cited `sources` (with `own` marked), `ownDomainCited`, `brandMentioned` and `tracked`. One prompt search and one relevance check per keyword, cached for 24 hours. US English only. Requires a paid plan in hosted mode.
- `explore_prompt`: optional. Asks ChatGPT one prompt through its API and returns today's answer, citations, a `brandMentioned` flag for `highlightBrand`, and `fanOutQueries`, the web searches the model ran before answering. Charged at actual usage per uncached answer; cached answers are free for seven days. Requires a paid plan in hosted mode.
- `list_saved_keywords` and, when connected, a bounded `get_search_console_performance` read: free sources of head terms the business already cares about.

Research uses usage credits. The questions come mostly from Google "People also ask" data, not logged ChatGPT prompts, and nobody can see how often a question is asked in ChatGPT. Never present a question as a real user prompt or attach a demand number to it.

## Workflow

### 1. Pick head terms

Build 5–15 candidate head terms of one to three words: the product category, the main problems it solves, and the use cases the business names. Take them from project context, saved keywords and Search Console queries before inventing new ones. Exact long phrases return few prompts; "crm" beats "best crm for small agencies".

Pick the two to four terms that fit the business best. Name the ones you dropped and why in one line.

### 2. Research the prompts

Call `research_ai_visibility_prompts` once per chosen term. Each call returns up to about 100 prompts with their sources, so keep to two or three terms unless the user asks for more, and summarize each result before the next call. Prompts about other meanings of the same words are filtered out, so an ambiguous or niche term can return only a few. If a term returns nothing, retry once with a shorter or broader form before dropping it.

If the market is not US English, say so before spending: research results cover US English questions and ChatGPT answers only. They can still suggest themes, but do not present them as the user's market.

### 3. Group by what the person wants

Group the returned prompts by intent, not by wording:

- **Learning**: how something works, what a term means.
- **Choosing**: best tools, comparisons, alternatives, recommendations for a situation.
- **Doing**: how to accomplish a task, step-by-step help.
- **Branded**: prompts that name the brand or a competitor. Keep these separate; they measure reputation, not discovery.

Related terms return overlapping prompts: one prompt can contain the words of two researched terms and come back from both calls. Before grouping, merge the prompts from all calls by their normalized text (lowercase, trimmed, collapsed whitespace), keep one copy with its sources, and note which terms returned it.

Drop prompts that share the words but not the market, such as academic "keyword research paper" prompts for an SEO tool, and say how many you dropped. Count source domains by registrable domain: `www.semrush.com`, `semrush.com` and `sv.semrush.com` are one domain. Prompts with an empty `sources` list have no recorded citations; count them separately rather than as answers that cite nobody.

For each group, record the number of distinct prompts, how many cite th

BLOCKgrade F · trust 24/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (7 observation(s))

Network

declared (15 observation(s))

Shell

declared (3 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

- **Hosted OpenSEO:** Prefer OAuth and let me approve login in my browser. If this client cannot use OAuth, send me to `https://app.openseo.so/settings` → API keys. Have me enter the key in the client

exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;

exec(query: string): Promise<D1ExecResult>;

"metadata.google.internal",

"169.254.169.254",

//     "localConnectionString": "postgres://openseo:openseo@localhost:5433/openseo",

//     "localConnectionString": "postgres://openseo:openseo@localhost:5433/openseo",

.claude/skills/create-repo-skill

.claude/skills/deslop

.claude/skills/evaluate-skill

.claude/skills/merge-ready

.claude/skills/observability-triage

"Beacon Tutoring",

run.endpoint = `http://127.0.0.1:${gateway.address().port}/mcp`;

CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3001)+'/api/health').then(function(r){process.exit(r.ok?0:1)}).catch(function(){process.exit(1)})"

if curl -fsS -X POST http://127.0.0.1:8081/reload >/dev/null 2>&1; then ready=1; break; fi

postgres://openseo:openseo@localhost:5433/openseo

POSTGRES_DATABASE_URL=postgres://openseo:openseo@localhost:5433/openseo \

SECRET: "test-secret-that-is-at-least-32-chars",

.oxlintrc.json

.prettierignore

.env.preview.example

.env.selfhost.example

.prettierignore

new URL("../../deploy/standalone/compose.yaml", import.meta.url),

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.

[![ModelsAtlas audit: OpenSEO](https://modelsatlas.com/skills/every-app/maintain-greptile-rules/badge.svg)](https://modelsatlas.com/skills/every-app/maintain-greptile-rules/)

Not your listing, or something out of date? Claim or update your listing.