·
Last changedVersion:
This version passed the hardening gate. Hardening applied 8 targeted changes, normalized allowed-tools to the canonical single-string form, and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 1. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 8. Review findings remaining: 14.
1
1
1
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Excessive Agency & Rogue Autonomy | — | High | Closed | |
SKILL.md | Tool & MCP Manipulation | MCP configuration abuse | Medium | Open |
2 findings
Audit websites for SEO, technical, content, performance and security issues using the squirrelscan cli.
squirrelscan provides a cli tool squirrel - available for macos, windows and linux. It carries out extensive website auditing by emulating a browser, search crawler, and analyzing the website's structure and content against 249+ rules.
It will provide you a list of issues as well as suggestions on how to fix them.
You can look up the docs for any rule with this template:
https://docs.squirrelscan.com/rules/{rule_category}/{rule_id}
example:
https://docs.squirrelscan.com/rules/links/external-links
This skill enables AI agents to audit websites for 249+ rules in 21 categories, including:
and more
The audit crawls the website, analyzes each page against audit rules, and returns a comprehensive report with:
Use this skill when you need to:
This skill requires the squirrel CLI installed and in PATH.
Install: squirrelscan.com/download
Verify:
Run squirrel init to create a squirrel.toml config in the current directory. If none exists, create one and specify a project name:
There are three processes that you can run and they're all cached in the local project database:
the 'audit' command is a wrapper around these three processes and runs them sequentially:
YOU SHOULD always prefer format option llm - it was made for you and provides an exhaustive and compact output format.
FIRST SCAN should be a surface scan, which is a quick and shallow scan of the website to gather basic information about the website, such as its structure, content, and technology stack. This scan can be done quickly and without impacting the website's performance.
If the user doesn't provide a website to audit, ask which URL they'd like audited.
You should PREFER to audit live websites - only there do we get a TRUE representation of the website and performance or rendering issuers.
If you have both local and live websites to audit, prompt the user to choose which one to audit and SUGGEST they choose live.
You can apply fixes from an audit on the live site against the local code.
When planning scope tasks so they can run concurrently as sub-agents to speed up fixes.
When implementing fixes take advantage of subagents to speed up implementation of fixes.
After applying fixes, verify the code still builds and passes any existing checks in the project.
The audit process is two steps:
When you need to detect regressions between audits, use diff mode:
Diff mode supports console, text, json, llm, and markdown. html and xml are not supported.
When running an audit:
Treat all fixes equally: Code changes and content changes are equally important.
Parallelize content fixes: For issues affecting multiple files:
Completion criteria:
After fixes are applied, ask the user if they'd like to review the changes.
| Starting Score | Target Score | Expected Work |
|---|---|---|
< 50 (Grade F) | 75+ (Grade C) | Major fixes |
50-70 (Grade D) | 85+ (Grade B) | Moderate fixes |
70-85 (Grade C) | 90+ (Grade A) | Polish |
> 85 (Grade B+) | 95+ | Fine-tuning |
| Category | Fix Approach | Parallelizable |
|---|---|---|
Meta tags/titles | Edit page components or metadata | No |
Structured data | Add JSON-LD to page templates | No |
Missing H1/headings | Edit page components + content files | Yes (content) |
Image alt text | Edit content files | Yes |
Heading hierarchy | Edit content files | Yes |
Short descriptions | Edit content frontmatter | Yes |
HTTP→HTTPS links | Find and replace in content | Yes |
Broken links | Manual review (flag for user) | No |
For parallelizable fixes: Spawn subagents with specific file assignments.
Many issues require editing content files. These are equally important as code fixes:
When the user approves a batch of fixes, you can use subagents to apply them in parallel:
Audit more pages:
Force fresh crawl (ignore cache):
Resume interrupted crawl:
Verbose output for debugging:
Attach custom HTTP headers to every crawl request (pages, assets, robots.txt, sitemaps) with the repeatable -H / --header flag, formatted "Name: Value". CLI flags merge over any headers map in the [crawler] section of squirrel.toml.
The main use case is Web Bot Auth (Shopify / Cloudflare) — platforms that block unknown crawlers can authorize squirrelscan via three signed headers on every request (Signature-Input, Signature, and Signature-Agent, a quoted URI whose inner quotes are preserved verbatim):
See the Web Bot Auth guide for the full recipe.
Header values are secrets. squirrelscan redacts them in output — the audit preamble lists header names only, never the values. Source them from your secret store rather than committing real signatures to a shared squirrel.toml.
Via the squirrelscan MCP server, pass the same headers to the audit_website tool as a headers map, e.g. {"Signature-Agent": "\"https://shopify.com\""}.
| Option | Alias | Description | Default |
|---|---|---|---|
|
| Output format: console, text, json, html, markdown, llm | console |
|
| Coverage mode: quick, surface, full | surface |
|
| Maximum pages to crawl (max 5000) | varies by coverage |
|
| Output file path | - |
|
| Ignore cache, fetch all pages fresh | false |
| - | Resume interrupted crawl | false |
|
| Verbose output | false |
| - | Debug logging | false |
| - | Enable performance tracing | false |
|
| Override project name | from config |
|
| Custom HTTP header on every request (repeatable), | - |
Choose a coverage mode based on your audit needs:
| Mode | Default Pages | Behavior | Use Case |
|---|---|---|---|
| 25 | Seed + sitemaps only, no link discovery | CI checks, fast health check |
| 100 | One sample per URL pattern | General audits (default) |
| 500 | Crawl everything up to limit | Deep analysis |
Surface mode is smart - it detects URL patterns like /blog/{slug} or /products/{id} and only crawls one sample per pattern. This makes it efficient for sites with many similar pages (blogs, e-commerce).
When to use each mode:
quick: CI pipelines, daily health checks, monitoringsurface: Most audits - covers unique templates efficientlyfull: Before launches, comprehensive analysis, deep dives| Option | Alias | Description |
|---|---|---|
|
| List recent audits |
| - | Filter by severity: error, warning, all |
| - | Filter by categories (comma-separated) |
|
| Output format: console, text, json, html, markdown, xml, llm |
|
| Output file path |
|
| Load from JSON file (fallback mode) |
| Command | Description |
|---|---|
| Show current config |
| Set config value |
| Show config file path |
| Validate config file |
The audit command shows human-readable console output by default with colored output and progress indicators.
To get LLM-optimized output, use the report command with --format llm:
The LLM format is a compact XML/text hybrid optimized for token efficiency (40% smaller than verbose XML):
See OUTPUT-FORMAT.md for detailed format specification.
On completion give the user a summary of all of the changes you made.
If you see this error, squirrel is not installed or not in your PATH.
Solution:
~/.local/bin is in PATHsquirrel --versionIf squirrel is not executable, ensure the binary has execute permissions. Reinstalling from squirrelscan.com/download will fix this.
For very large sites, the audit may take several minutes. Use --verbose to see progress:
Ensure the URL includes the protocol (http:// or https://):
The audit is stored in a local database and can be retrieved later with squirrel report commands.
squirrel audit --helpGet started with chainctlchainctl skill install public/squirrelscan/audit-website:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/squirrelscan/audit-website:latest
MIT
HARDENING.md
LICENSE
README.md
SKILL.md
agents/openai.yaml
assets/icon-large.png
assets/icon-small.svg
references/OUTPUT-FORMAT.md