C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · General
notfair-plugin
Open-source SEO, GEO, and marketing skills for AI agents.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 41/100
- Rank
- #310 of 500
- GitHub stars
- 3.9k
What it does
notfair-plugin provides open-source SEO, GEO, and marketing skills for AI agents, enabling them to perform search optimization, geolocation-based tasks, and marketing automation workflows. It appears designed as a modular skill set that agents can integrate to handle marketing and geo-targeting operations.
Who it’s for
Builders creating AI agents that need SEO, geolocation, or marketing capabilities. Marketing teams and agencies exploring agent-based automation for campaign optimization and geo-targeted outreach.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/nowork-studio/notfair-plugin (opens external site) for current installation instructions, as the standard approach is likely:
npm install notfair-plugin
Then integrate into your agent framework per the repository's documentation. For Claude Desktop or MCP-based setups, check the repo for mcpServers configuration examples.
Risks
- Credential scope: Marketing and GEO APIs may require broad access to customer data, analytics, or location services; verify permission boundaries
- Prompt injection: SEO and marketing skills that parse user queries or external data could be vulnerable to injection attacks if inputs aren't sanitized
- Data exfiltration: Geolocation and customer targeting features may move sensitive PII or behavioral data to third-party APIs without explicit audit trails
- Supply-chain maturity: Zero npm downloads and no activity signals suggest low adoption; inactive maintenance increases risk of unpatched vulnerabilities
- API key exposure: Typically requires marketing platform credentials; ensure keys are never logged, cached, or exposed in agent outputs
How to stay secure
Security Hardening Guide: notfair-plugin
Least-privilege permissions
- Limit API access: Only grant the plugin permission to access specific marketing tools or location services it actually needs—not blanket access to all customer data or analytics platforms
- Separate credentials: Use dedicated API keys (login credentials for third-party services) for this plugin instead of shared company-wide keys; if one key leaks, only this tool is compromised
- Audit third-party connections: Before activating, verify which external services (like Google Maps or marketing platforms) the plugin will connect to and what data they receive
- Regular access reviews: Monthly check that the plugin still needs the same permissions; remove access to any service it no longer uses
Network isolation
- Restrict outbound connections: Configure your network firewall to allow the plugin to contact only approved marketing APIs and geolocation services—block all other traffic
- No internal data sharing: Prevent the plugin from accessing your internal databases, employee systems, or corporate networks; it should only interact with external services
- Separate sandbox environment: Run the plugin in an isolated testing environment first before deploying it to production systems to catch unexpected data flows
Monitoring
- Log all API calls: Record every request the plugin sends to external services, including what data is being transmitted and where it's going
- Alert on unusual activity: Set up automatic notifications if the plugin suddenly requests excessive data, contacts unexpected services, or operates outside normal hours
- Review data movement: Regularly inspect what customer information (names, locations, behavior) is actually leaving your system through this plugin
Red flags to watch for
- Outdated code: The plugin shows zero downloads and no recent updates—this suggests it may contain unpatched security flaws; verify it has active maintenance before use
- Data in logs: If API keys, customer information, or geolocation details appear in system logs or debug output, stop using the plugin immediately and contact support
- Vague data requests: If the plugin requests permission to access "all analytics data" or "any customer information" rather than specific fields, reject the request and demand clearer scoping
- Unexpected third-party sharing: If you notice customer location data or marketing insights being sent to services you didn't authorize, disable the plugin and investigate immediately
Alternatives
- SerpAPI / Bright Data – Commercial APIs for SEO and geo-data; higher trust but requires paid subscription and vendor lock-in
- Semrush / Ahrefs integrations – Industry-standard tools with agent plugins; mature but expensive
- Custom skill modules – Build marketing skills in-house using LLM-native tools like LangChain agents and public APIs
- MCP connector wrappers – Use community MCP connectors for Google Search, Bing Geo, or Stripe if marketing is transactional