Squirrelscan Website Audit Skill
Audit websites for SEO, performance, security, accessibility and structured data issues across 260+ rules via the squirrel CLI, returning a health score and actionable fixes.
Least-privilege allowlist (Bash(squirrel:*) and Read), clear secret-handling guidance (never commit, use secret store, output redaction), and escape hatches (--offline/--no-publish), confirm-before-prune with --dry-run; data flows (cloud publish, telemetry, credit billing) largely disclosed. Deducted for: default publishing to cloud (unlisted) and default telemetry/billing paths, self-update pulling a binary from an external source, unverified publisher identity, and a broad squirrel:* scope that includes keys/auth.
Docs are self-consistent with a command table, troubleshooting (command not found, 401, slow crawl, invalid URL), and self doctor feedback paths; failure messages are well designed. Deducted for: no committed tests or reproducible validation of key paths; abnormal-input behavior is mostly prose; static review cannot execute, capped at 10.
Trigger description is clear (when to use, boundary vs companion audit-website skill, --format llm for agents); inputs, output formats, coverage modes and non-fit ranges are mostly clear. Deducted for: cloud features (publishing, rendering, hosted MCP) depend entirely on overseas endpoints with no mainland-China reachability statement; version-dependent behavior (requires 0.0.92+) is a hidden prerequisite.
Well-layered structure (install → commands → quickstart → auth → reports → maintenance → troubleshooting), MIT license, version 1.3, explicit maintenance commands and update path. Deducted for: no changelog, no centralized known-limitations disclosure, thin version governance, and author attribution is a name without verifiable ownership.
Goal is clear (audit a site, return fixable issues); llm output format, diffs, and CI fail-on thresholds are directly agent-usable, with a free local mode. Deducted for: no representative output samples verifiable in static review, core value depends on installing an external binary and unverified cloud services, and comparative-benefit evidence is thin.
Key claims (260+ rules, 96 secret-detection patterns) are author statements only; no third-party execution evidence, committed tests, or CI in the provided files. Only internal consistency of repo, license, and docs serves as weak corroboration, hence below 5.
- Core cloud features (report publishing, browser rendering, hosted MCP) rely on overseas endpoints with no stated mainland-China reachability; use --offline when isolation matters.
- Audits publish to the cloud (unlisted) by default and include telemetry; use --no-publish/--offline if data egress is a concern.
- Self-update downloads a binary from an external source; verify provenance in a controlled environment before running.
- Publisher identity is unverified; key capability claims (260+ rules, 96 secret patterns) are author assertions, not independently validated.
- Pruning history (--prune) irreversibly retires old audits; agents should follow the doc's requirement to confirm with the user first.
What does this skill do, and when should you use it?
The squirrelscan skill lets an AI agent operate the squirrelscan website audit tool end to end: installing the CLI, authenticating, running audits, publishing reports, managing cloud credits, configuration, and troubleshooting. The tool crawls a site like a search engine, analyzes every page against 260+ rules in 21 categories, and returns a health score with concrete, fixable issues. Local audits are free and run entirely on your machine with no account needed; cloud features such as report publishing, browser rendering, and scheduled crawls are pay-as-you-go with credits.
Runs squirrel audit <url> to crawl, analyze, and report in one step, with quick (25 pages), surface (100), and full (500) coverage modes. Produces output in console, text, , html, markdown, xml, and a token-optimized --format llm for agents. Generates regression diffs between audits (report --diff), publishes shareable reports to reports.squirrelscan.com, and supports CI gating via --fail-on "score<90". Also connects agents over MCP via squirrel mcp (local stdio) or the hosted server, and exposes the send_feedback tool for mid-session bug reports.
- A developer wants a pre/post-deploy health check and asks the agent to run `squirrel audit https://example.com --format llm` and summarize critical issues
- A CI engineer wants to block quality regressions, configuring SQUIRRELSCAN_API_KEY and `--fail-on "score<90"` in a headless pipeline
- A team investigating exposed secrets (96 patterns including OpenAI, AWS, Stripe) scans their site with the security rules
- A maintainer low on disk space reclaims it with `squirrel self disk --prune --keep 3`
- An agent on an MCP-capable client queries audit results live via the hosted server at mcp.squirrelscan.com
- A platform behind Shopify/Cloudflare bot protection authorizes crawls using custom Web Bot Auth headers
What are this skill's strengths and limitations?
- Local audits are free, run fully on your machine, need no account, and support a fully offline --offline mode
- LLM-native output (--format llm) is token-optimized for agent consumption
- 260+ rules across 21 categories, including practical secret-leak detection
- Both local stdio and hosted MCP integration, plus solid CI gating and regression diffs
- Audits are cached locally, so reports re-render without re-crawling
- Requires the squirrel CLI installed and in PATH; the skill cannot function without it
- Cloud features (browser rendering, publishing, scheduled crawls) cost credits; exact pricing requires running `squirrel credits`
- Full mode caps at 500 pages by default, limiting very large site coverage
- Offline mode excludes cloud rendering and report publishing
- No independent test suite or third-party evaluation evidence in the source material
How do you install this skill?
Prerequisite: install the squirrel CLI (squirrelscan.com/download); the binary lands in ~/.local/bin/squirrel and must be in PATH. Install the skill via:
- Any agent: npx skills add squirrelscan/skills (add --skill squirrelscan for just this one)
- Claude Code: /plugin marketplace add squirrelscan/skills then /plugin install squirrelscan@squirrelscan
- squirrel CLI: squirrel skills install
- Manual: clone the repo and symlink/copy skills/squirrelscan into your agent's skills directory.
How do you use this skill?
Example prompts: "Audit example.com and show me the top 5 critical issues" or "Check my site for broken links and leaked secrets." Common commands:
bash
squirrel init -n my-project
squirrel audit https://example.com --format llm # quick mode (25 pages) by default
squirrel audit https://example.com -C full -m 500 --format llm
squirrel report --list
squirrel report <audit-id> --format markdown -o report.md
squirrel auth login # needed for cloud features; CI uses SQUIRRELSCAN_API_KEY
Local audits are free; add --offline for no cloud contact at all. Troubleshooting: on 401, re-run squirrel auth login or check the API key; if the command is not found, ensure ~/.local/bin is in PATH.