What does this skill do, and when should you use it?
This skill drives the squirrel CLI to audit websites against 260+ rules in 21 categories spanning SEO, performance, security, accessibility, and content, returning a token-efficient LLM-optimized report. It then runs an iterative fix loop: mapping each finding to the template, component, or content file behind it, applying user-approved fixes in batches, and re-auditing with before/after score comparisons. It supports three scan depths (quick/surface/full), baseline diff regression checks, and per-rule documentation lookups. Best suited to web developers and teams who want an agent to actually fix issues, not just list them.
Runs squirrel audit <url> --format llm; reads the health score, category-grouped issues, broken links, and prioritized recommendations; locates each finding in source using Grep/Glob/Read; applies approved fixes in batches with Edit; verifies the project still builds after each batch; re-audits with --refresh and proves improvement via squirrel report --diff against a baseline; flags judgment-call findings (e.g., whether to remove a link) for human review instead of guessing. For sites blocking unknown crawlers (Shopify/Cloudflare), it passes Web Bot Auth headers.
- A web developer auditing a site pre-launch and fixing SEO, accessibility, and security deductions
- A team running quick-mode scans in CI and signing off with a full crawl before release
- A maintainer inheriting a legacy site, using audit findings ranked by severity to plan remediation
- Ops re-auditing after each deploy and using diff reports to prove no regressions were introduced
- A security lead sweeping a site for leaked secrets (96 patterns: OpenAI, AWS, Stripe, and more)
How do you install this skill?
- This is a static source review only; no commands were executed and all functional claims are unverified at runtime.
- Core function depends on a proprietary CLI and overseas-hosted services; mainland-China reachability is unverified — confirm access to squirrelscan.com and docs.squirrelscan.com before use.
- Audits send your site URLs and findings (potentially sensitive, e.g. leaked-secrets detections) to a third-party service; assess data-egress risk.
- Score-target tables and rule counts are vendor claims without independent corroboration.
- Shell / CLI
- Network access
- Local filesystem
squirrel CLI in PATH
Prerequisite: install the squirrel CLI and ensure it's in PATH (https://squirrelscan.com/download; verify with squirrel --version). Install the skill: any agent via npx skills add squirrelscan/skills, or just this one: npx skills add squirrelscan/skills --skill audit-website; Claude Code via /plugin marketplace add squirrelscan/skills then /plugin install squirrelscan@squirrelscan; or git clone https://github.com/squirrelscan/skills.git and symlink skills/audit-website into your agent's skills directory. MIT licensed.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/squirrelscan/skills.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/audit-website" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Audit this website and fix all errors and warnings
- Run an audit on example.com and show me the top 5 critical issues
Example prompts: "Audit this website and fix all errors and warnings" or "Run an audit on example.com and show me the top 5 critical issues". The skill starts with a quick shallow scan; use -C surface (one page per URL pattern) or -C full (500-page comprehensive, for sign-off) for deeper coverage. Score targets: F (<50) aim for 75+, D for 85+, C for 90+. Always re-audit with --refresh after deploys or content changes.
What are this skill's strengths and limitations?
- Closes the loop: not just detection but a full fix-re-audit cycle with score targets and regression verification
- LLM report format is built for token efficiency; rules are documented per-ID at docs.squirrelscan.com
- Explicitly requires flagging judgment calls (like broken-link decisions) back to the user rather than guessing
- Three scan depths, resumable crawls, cached re-renders, and Web Bot Auth for bot-blocking sites
- Hard dependency on the closed-source squirrel CLI (installation plus likely account/credits usage; pricing not documented in the source)
- No automated test suite in the repo and no independent evaluation of the v2.1 skill's fix quality
- Prefers auditing the live site, so some local-rendering or performance issues may go undetected
- Live audits need network access and adequate page budgets (quick defaults to only 25 pages; full requires 500)
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| squirrelscan Website Audit & Fix Loop this page | 49 · Use with care | ★ 99 | 13d ago | MIT |
| Squirrelscan Website Audit Skill | 53 · Use with care | ★ 99 | 13d ago | MIT |
| SwiftUI Pro | 57 · Use with care | ★ 5.9k | 19d ago | MIT |
| SwiftUI Pro | 51 · Use with care | ★ 5.9k | 19d ago | MIT |
| Open Code Review Skill | 58 · Recommended | ★ 47k | 12d ago | Apache-2.0 |
How did FollowSkills review this skill?
Skill requires user confirmation before modifying code, declares a scoped tool allowlist (Bash(squirrel:*), Read/Edit/Grep/Glob), notes secret redaction for header values, and its data flow is mostly transparent. Deducted for: reliance on an unaudited proprietary external CLI, sending user site URLs to third-party hosted services with no discussion of server-side data handling, and no rollback guidance.
Instructions are internally consistent: scan progression, caching, and re-audit flow cohere, with a concrete countermeasure for blocked crawlers. Deducted for: no test suite or CI evidence for this skill's key paths, and undescribed behavior/error feedback on abnormal inputs (invalid URLs, auth failure, quota exhaustion).
Scenario is clear (website health audit and fix loop), trigger description is precise, and the fix-loop/score-target tables are practical. Deducted for: undeclared capability boundaries (intranet sites, login-required pages), complete dependence on overseas-hosted services (squirrelscan.com, docs.squirrelscan.com, hosted MCP) with uncertain mainland-China reachability, and no Chinese-language support.
Good doc layering (SKILL.md + OUTPUT-FORMAT.md reference + companion-skill split), version 2.1, MIT license, install notes, and tool metadata. Deducted for: no changelog, no known-limitations section, maintenance ownership and update path only implicit, and rule-doc links pointing to an unverified external site.
The claimed fix loop maps to concrete commands and a clear definition of done, giving a plausible marginal value over manual auditing. Deducted for: static review cannot verify the 260+ rules or 40-70% size-reduction vendor claims, output usability is unverified by execution, and the score-target table lacks a stated basis.
A detailed output-format spec, example outputs, and rule-doc URLs allow cross-checking format claims. Deducted for: no test suite or CI workflow covering the skill's key paths; rule counts and token-efficiency figures are single-source vendor claims not independently reproducible.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →