squirrelscan Website Audit & Fix Loop
Audit a website with the squirrelscan CLI, map findings to source code, fix in batches, and re-audit until the score target is met.
Skill requires user confirmation before modifying code, declares a scoped tool allowlist (Bash(squirrel:*), Read/Edit/Grep/Glob), notes secret redaction for header values, and its data flow is mostly transparent. Deducted for: reliance on an unaudited proprietary external CLI, sending user site URLs to third-party hosted services with no discussion of server-side data handling, and no rollback guidance.
Instructions are internally consistent: scan progression, caching, and re-audit flow cohere, with a concrete countermeasure for blocked crawlers. Deducted for: no test suite or CI evidence for this skill's key paths, and undescribed behavior/error feedback on abnormal inputs (invalid URLs, auth failure, quota exhaustion).
Scenario is clear (website health audit and fix loop), trigger description is precise, and the fix-loop/score-target tables are practical. Deducted for: undeclared capability boundaries (intranet sites, login-required pages), complete dependence on overseas-hosted services (squirrelscan.com, docs.squirrelscan.com, hosted MCP) with uncertain mainland-China reachability, and no Chinese-language support.
Good doc layering (SKILL.md + OUTPUT-FORMAT.md reference + companion-skill split), version 2.1, MIT license, install notes, and tool metadata. Deducted for: no changelog, no known-limitations section, maintenance ownership and update path only implicit, and rule-doc links pointing to an unverified external site.
The claimed fix loop maps to concrete commands and a clear definition of done, giving a plausible marginal value over manual auditing. Deducted for: static review cannot verify the 260+ rules or 40-70% size-reduction vendor claims, output usability is unverified by execution, and the score-target table lacks a stated basis.
A detailed output-format spec, example outputs, and rule-doc URLs allow cross-checking format claims. Deducted for: no test suite or CI workflow covering the skill's key paths; rule counts and token-efficiency figures are single-source vendor claims not independently reproducible.
- This is a static source review only; no commands were executed and all functional claims are unverified at runtime.
- Core function depends on a proprietary CLI and overseas-hosted services; mainland-China reachability is unverified — confirm access to squirrelscan.com and docs.squirrelscan.com before use.
- Audits send your site URLs and findings (potentially sensitive, e.g. leaked-secrets detections) to a third-party service; assess data-egress risk.
- Score-target tables and rule counts are vendor claims without independent corroboration.
What does this skill do, and when should you use it?
This skill drives the squirrel CLI to audit websites against 260+ rules in 21 categories spanning SEO, performance, security, accessibility, and content, returning a token-efficient LLM-optimized report. It then runs an iterative fix loop: mapping each finding to the template, component, or content file behind it, applying user-approved fixes in batches, and re-auditing with before/after score comparisons. It supports three scan depths (quick/surface/full), baseline diff regression checks, and per-rule documentation lookups. Best suited to web developers and teams who want an agent to actually fix issues, not just list them.
Runs squirrel audit <url> --format llm; reads the health score, category-grouped issues, broken links, and prioritized recommendations; locates each finding in source using Grep/Glob/Read; applies approved fixes in batches with Edit; verifies the project still builds after each batch; re-audits with --refresh and proves improvement via squirrel report --diff against a baseline; flags judgment-call findings (e.g., whether to remove a link) for human review instead of guessing. For sites blocking unknown crawlers (Shopify/Cloudflare), it passes Web Bot Auth headers.
- A web developer auditing a site pre-launch and fixing SEO, accessibility, and security deductions
- A team running quick-mode scans in CI and signing off with a full crawl before release
- A maintainer inheriting a legacy site, using audit findings ranked by severity to plan remediation
- Ops re-auditing after each deploy and using diff reports to prove no regressions were introduced
- A security lead sweeping a site for leaked secrets (96 patterns: OpenAI, AWS, Stripe, and more)
What are this skill's strengths and limitations?
- Closes the loop: not just detection but a full fix-re-audit cycle with score targets and regression verification
- LLM report format is built for token efficiency; rules are documented per-ID at docs.squirrelscan.com
- Explicitly requires flagging judgment calls (like broken-link decisions) back to the user rather than guessing
- Three scan depths, resumable crawls, cached re-renders, and Web Bot Auth for bot-blocking sites
- Hard dependency on the closed-source squirrel CLI (installation plus likely account/credits usage; pricing not documented in the source)
- No automated test suite in the repo and no independent evaluation of the v2.1 skill's fix quality
- Prefers auditing the live site, so some local-rendering or performance issues may go undetected
- Live audits need network access and adequate page budgets (quick defaults to only 25 pages; full requires 500)
How do you install this skill?
Prerequisite: install the squirrel CLI and ensure it's in PATH (https://squirrelscan.com/download; verify with squirrel --version). Install the skill: any agent via npx skills add squirrelscan/skills, or just this one: npx skills add squirrelscan/skills --skill audit-website; Claude Code via /plugin marketplace add squirrelscan/skills then /plugin install squirrelscan@squirrelscan; or git clone https://github.com/squirrelscan/skills.git and symlink skills/audit-website into your agent's skills directory. MIT licensed.
How do you use this skill?
Example prompts: "Audit this website and fix all errors and warnings" or "Run an audit on example.com and show me the top 5 critical issues". The skill starts with a quick shallow scan; use -C surface (one page per URL pattern) or -C full (500-page comprehensive, for sign-off) for deeper coverage. Score targets: F (<50) aim for 75+, D for 85+, C for 90+. Always re-audit with --refresh after deploys or content changes.