56 results available
Sign in
Skills directory

audit-website

squirrelscan

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 8 targeted changes, normalized allowed-tools to the canonical single-string form, and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 1. Classified findings remaining: 1. Unclassified scanner findings remaining: 0. Review findings closed: 8. Review findings remaining: 14.


Open before hardening

1

High

1

Medium
Open after hardening

1

Medium

Expand
File
Group
Subtype
Severity
Status
SKILL.md

Excessive Agency & Rogue Autonomy

—

High
Closed
SKILL.md

Tool & MCP Manipulation

MCP configuration abuse

Medium
Open

2 findings


SKILL.md

Website Audit Skill

Audit websites for SEO, technical, content, performance and security issues using the squirrelscan cli.

squirrelscan provides a cli tool squirrel - available for macos, windows and linux. It carries out extensive website auditing by emulating a browser, search crawler, and analyzing the website's structure and content against 249+ rules.

It will provide you a list of issues as well as suggestions on how to fix them.

  • squirrelscan website is at https://squirrelscan.com
  • documentation (including rule references) are at docs.squirrelscan.com

You can look up the docs for any rule with this template:

https://docs.squirrelscan.com/rules/{rule_category}/{rule_id}

example:

https://docs.squirrelscan.com/rules/links/external-links

What This Skill Does

This skill enables AI agents to audit websites for 249+ rules in 21 categories, including:

  • SEO issues: Meta tags, titles, descriptions, canonical URLs, Open Graph tags
  • Technical problems: Broken links, redirect chains, page speed, mobile-friendliness
  • Performance: Page load time, resource usage, caching
  • Content quality: Heading structure, image alt text, content analysis
  • Security: Leaked secrets, HTTPS usage, security headers, mixed content
  • Accessibility: Alt text, color contrast, keyboard navigation
  • Usability: Form validation, error handling, user flow
  • Links: Checks for broken internal and external links
  • E-E-A-T: Expertise, Experience, Authority, Trustworthiness
  • User Experience: User flow, error handling, form validation
  • Mobile: Checks for mobile-friendliness, responsive design, touch-friendly elements
  • Crawlability: Checks for crawlability, robots.txt, sitemap.xml and more
  • Schema: Schema.org markup, structured data, rich snippets
  • Legal: Compliance with legal requirements, privacy policies, terms of service
  • Social: Open graph, twitter cards and validating schemas, snippets etc.
  • Url Structure: Length, hyphens, keywords
  • Keywords: Keyword stuffing
  • Content: Content structure, headings
  • Images: Alt text, color contrast, image size, image format
  • Local SEO: NAP consistency, geo metadata
  • Video: VideoObject schema, accessibility

and more

The audit crawls the website, analyzes each page against audit rules, and returns a comprehensive report with:

  • Overall health score (0-100)
  • Category breakdowns (core SEO, technical SEO, content, security)
  • Specific issues with affected URLs
  • Broken link detection
  • Actionable recommendations
  • Rules have levels of error, warning and notice and also have a rank between 1 and 10

When to Use

Use this skill when you need to:

  • Analyze a website's health
  • Debug technical SEO issues
  • Fix all of the issues mentioned above
  • Check for broken links
  • Validate meta tags and structured data
  • Generate site audit reports
  • Compare site health before/after changes
  • Improve website performance, accessibility, SEO, security and more.

Prerequisites

This skill requires the squirrel CLI installed and in PATH.

Install: squirrelscan.com/download

Verify:

squirrel --version

Setup

Run squirrel init to create a squirrel.toml config in the current directory. If none exists, create one and specify a project name:

squirrel init -n my-project

Usage

Intro

There are three processes that you can run and they're all cached in the local project database:

  • crawl - subcommand to run a crawl or refresh, continue a crawl
  • analyze - subcommand to analyze the crawl results
  • report - subcommand to generate a report in desired format (llm, text, console, html etc.)

the 'audit' command is a wrapper around these three processes and runs them sequentially:

squirrel audit https://example.com --format llm

YOU SHOULD always prefer format option llm - it was made for you and provides an exhaustive and compact output format.

FIRST SCAN should be a surface scan, which is a quick and shallow scan of the website to gather basic information about the website, such as its structure, content, and technology stack. This scan can be done quickly and without impacting the website's performance.

If the user doesn't provide a website to audit, ask which URL they'd like audited.

You should PREFER to audit live websites - only there do we get a TRUE representation of the website and performance or rendering issuers.

If you have both local and live websites to audit, prompt the user to choose which one to audit and SUGGEST they choose live.

You can apply fixes from an audit on the live site against the local code.

When planning scope tasks so they can run concurrently as sub-agents to speed up fixes.

When implementing fixes take advantage of subagents to speed up implementation of fixes.

After applying fixes, verify the code still builds and passes any existing checks in the project.

Basic Workflow

The audit process is two steps:

  1. Run the audit (saves to database, shows console output)
  2. Export report in desired format
# Step 1: Run audit (default: console output)
squirrel audit https://example.com

# Step 2: Export as LLM format
squirrel report <audit-id> --format llm

Regression Diffs

When you need to detect regressions between audits, use diff mode:

# Compare current report against a baseline audit ID
squirrel report --diff <audit-id> --format llm

# Compare latest domain report against a baseline domain
squirrel report --regression-since example.com --format llm

Diff mode supports console, text, json, llm, and markdown. html and xml are not supported.

Running Audits

When running an audit:

  1. Present the report - show the user the audit results and score
  2. Propose fixes - list the issues you can fix and ask the user to confirm before making changes
  3. Parallelize approved fixes - use subagents for bulk content edits (alt text, headings, descriptions)
  4. Iterate - fix batch → re-audit → present results → propose next batch
  5. Pause for judgment - broken links, structural changes, and anything ambiguous should be flagged for user review
  6. Show before/after - present score comparison after each fix batch
  • Treat all fixes equally: Code changes and content changes are equally important.

  • Parallelize content fixes: For issues affecting multiple files:

    • Spawn subagents to fix in parallel
    • Example: 7 files need alt text → spawn 1-2 agents to fix all
    • Example: 30 files have heading issues → spawn agents to batch edit
  • Completion criteria:

    • ✅ All errors fixed
    • ✅ Re-audit confirms improvements
    • ✅ Before/after comparison shown to user

After fixes are applied, ask the user if they'd like to review the changes.

Score Targets

Starting ScoreTarget ScoreExpected Work

< 50 (Grade F)

75+ (Grade C)

Major fixes

50-70 (Grade D)

85+ (Grade B)

Moderate fixes

70-85 (Grade C)

90+ (Grade A)

Polish

> 85 (Grade B+)

95+

Fine-tuning

Issue Categories

CategoryFix ApproachParallelizable

Meta tags/titles

Edit page components or metadata

No

Structured data

Add JSON-LD to page templates

No

Missing H1/headings

Edit page components + content files

Yes (content)

Image alt text

Edit content files

Yes

Heading hierarchy

Edit content files

Yes

Short descriptions

Edit content frontmatter

Yes

HTTP→HTTPS links

Find and replace in content

Yes

Broken links

Manual review (flag for user)

No

For parallelizable fixes: Spawn subagents with specific file assignments.

Content File Fixes

Many issues require editing content files. These are equally important as code fixes:

  • Image alt text: Add descriptive alt text to images
  • Heading hierarchy: Fix skipped heading levels
  • Meta descriptions: Extend short descriptions in frontmatter
  • HTTP links: Update insecure links to HTTPS

Parallelizing Fixes with Subagents

When the user approves a batch of fixes, you can use subagents to apply them in parallel:

  • Ask the user first — always confirm which fixes to apply before spawning subagents
  • Group 3-5 files per subagent for the same fix type
  • Only parallelize independent files (no shared components or config)
  • Spawn multiple subagents in a single message for concurrent execution

Advanced Options

Audit more pages:

squirrel audit https://example.com --max-pages 200

Force fresh crawl (ignore cache):

squirrel audit https://example.com --refresh

Resume interrupted crawl:

squirrel audit https://example.com --resume

Verbose output for debugging:

squirrel audit https://example.com --verbose

Custom Request Headers

Attach custom HTTP headers to every crawl request (pages, assets, robots.txt, sitemaps) with the repeatable -H / --header flag, formatted "Name: Value". CLI flags merge over any headers map in the [crawler] section of squirrel.toml.

The main use case is Web Bot Auth (Shopify / Cloudflare) — platforms that block unknown crawlers can authorize squirrelscan via three signed headers on every request (Signature-Input, Signature, and Signature-Agent, a quoted URI whose inner quotes are preserved verbatim):

squirrel audit https://your-store.myshopify.com \
  -H 'Signature-Input: sig1=("@authority" "signature-agent");keyid="...";created=...' \
  -H 'Signature: sig1=:BASE64SIG:' \
  -H 'Signature-Agent: "https://shopify.com"' \
  --format llm

See the Web Bot Auth guide for the full recipe.

Header values are secrets. squirrelscan redacts them in output — the audit preamble lists header names only, never the values. Source them from your secret store rather than committing real signatures to a shared squirrel.toml.

Via the squirrelscan MCP server, pass the same headers to the audit_website tool as a headers map, e.g. {"Signature-Agent": "\"https://shopify.com\""}.

Common Options

Audit Command Options

OptionAliasDescriptionDefault

--format <fmt>

-f <fmt>

Output format: console, text, json, html, markdown, llm

console

--coverage <mode>

-C <mode>

Coverage mode: quick, surface, full

surface

--max-pages <n>

-m <n>

Maximum pages to crawl (max 5000)

varies by coverage

--output <path>

-o <path>

Output file path

-

--refresh

-r

Ignore cache, fetch all pages fresh

false

--resume

-

Resume interrupted crawl

false

--verbose

-v

Verbose output

false

--debug

-

Debug logging

false

--trace

-

Enable performance tracing

false

--project-name <name>

-n <name>

Override project name

from config

--header <spec>

-H <spec>

Custom HTTP header on every request (repeatable), "Name: Value"; merges over [crawler] headers

-

Coverage Modes

Choose a coverage mode based on your audit needs:

ModeDefault PagesBehaviorUse Case

quick

25

Seed + sitemaps only, no link discovery

CI checks, fast health check

surface

100

One sample per URL pattern

General audits (default)

full

500

Crawl everything up to limit

Deep analysis

Surface mode is smart - it detects URL patterns like /blog/{slug} or /products/{id} and only crawls one sample per pattern. This makes it efficient for sites with many similar pages (blogs, e-commerce).

# Quick health check (25 pages, no link discovery)
squirrel audit https://example.com -C quick --format llm

# Default surface audit (100 pages, pattern sampling)
squirrel audit https://example.com --format llm

# Full comprehensive audit (500 pages)
squirrel audit https://example.com -C full --format llm

# Override page limit for any mode
squirrel audit https://example.com -C surface -m 200 --format llm

When to use each mode:

  • quick: CI pipelines, daily health checks, monitoring
  • surface: Most audits - covers unique templates efficiently
  • full: Before launches, comprehensive analysis, deep dives

Report Command Options

OptionAliasDescription

--list

-l

List recent audits

--severity <level>

-

Filter by severity: error, warning, all

--category <cats>

-

Filter by categories (comma-separated)

--format <fmt>

-f <fmt>

Output format: console, text, json, html, markdown, xml, llm

--output <path>

-o <path>

Output file path

--input <path>

-i <path>

Load from JSON file (fallback mode)

Config Subcommands

CommandDescription

config show

Show current config

config set <key> <value>

Set config value

config path

Show config file path

config validate

Validate config file

Output Formats

Console Output (default)

The audit command shows human-readable console output by default with colored output and progress indicators.

LLM Format

To get LLM-optimized output, use the report command with --format llm:

squirrel report <audit-id> --format llm

The LLM format is a compact XML/text hybrid optimized for token efficiency (40% smaller than verbose XML):

  • Summary: Overall health score and key metrics
  • Issues by Category: Grouped by audit rule category (core SEO, technical, content, security)
  • Broken Links: List of broken external and internal links
  • Recommendations: Prioritized action items with fix suggestions

See OUTPUT-FORMAT.md for detailed format specification.

Examples

Example 1: Quick Site Audit with LLM Output

# User asks: "Check squirrelscan.com for SEO issues"
squirrel audit https://squirrelscan.com --format llm

Example 2: Deep Audit for Large Site

# User asks: "Do a thorough audit of my blog with up to 500 pages"
squirrel audit https://myblog.com --max-pages 500 --format llm

Example 3: Fresh Audit After Changes

# User asks: "Re-audit the site and ignore cached results"
squirrel audit https://example.com --refresh --format llm

Example 4: Two-Step Workflow (Reuse Previous Audit)

# First run an audit
squirrel audit https://example.com
# Note the audit ID from output (e.g., "a1b2c3d4")

# Later, export in different format
squirrel report a1b2c3d4 --format llm

Output

On completion give the user a summary of all of the changes you made.

Troubleshooting

squirrel command not found

If you see this error, squirrel is not installed or not in your PATH.

Solution:

  1. Install squirrel: squirrelscan.com/download
  2. Ensure ~/.local/bin is in PATH
  3. Verify: squirrel --version

Permission denied

If squirrel is not executable, ensure the binary has execute permissions. Reinstalling from squirrelscan.com/download will fix this.

Crawl timeout or slow performance

For very large sites, the audit may take several minutes. Use --verbose to see progress:

squirrel audit https://example.com --format llm --verbose

Invalid URL

Ensure the URL includes the protocol (http:// or https://):

# ✗ Wrong
squirrel audit example.com

# ✓ Correct
squirrel audit https://example.com

How It Works

  1. Crawl: Discovers and fetches pages starting from the base URL
  2. Analyze: Runs audit rules on each page
  3. External Links: Checks external links for availability
  4. Report: Generates LLM-optimized report with findings

The audit is stored in a local database and can be retrieved later with squirrel report commands.

Additional Resources

Install

Install with chainctl
chainctl skill install public/squirrelscan/audit-website:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/squirrelscan/skills
Upstream commitf558c34901cc4c263ec49a8fb0e2aab055de2bf4
OCI reference

skills.cgr.dev/public/github.com/squirrelscan/audit-website:latest

License

MIT

Files

HARDENING.md

LICENSE

README.md

SKILL.md

agents/openai.yaml

assets/icon-large.png

assets/icon-small.svg

references/OUTPUT-FORMAT.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.