Skills audit-website

📦

audit-website

Name: audit-website
Author: squirrelscan

v1.7 Content revision r1 Critical 🌐 Network access⚙️ External commands📁 Filesystem access

Audit Websites with squirrelscan

Website problems often hide across SEO, performance, accessibility, and security checks. This skill runs squirrelscan and turns crawl results into clear repair priorities.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "audit-website" from https://skillstore.io/skills/squirrelscan-audit-website.md and its manifest at https://skillstore.io/api/skills/squirrelscan-audit-website/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/squirrelscan-audit-website.md Signed manifest GET /api/skills/squirrelscan-audit-website/manifest Signed lockfile GET /api/skills/squirrelscan-audit-website/lockfile

Test it

Using "audit-website". Audit my product site and tell me what blocks launch readiness.

Expected outcome:

The report identifies missing titles, broken internal links, weak mobile checks, and missing security headers. It recommends fixing launch blockers before content warnings.

Using "audit-website". Check whether my recent SEO fixes worked.

Expected outcome:

The summary compares the fresh crawl with prior issues. It lists resolved metadata problems and remaining duplicate descriptions.

Using "audit-website". Review a large documentation site for crawl problems.

Expected outcome:

The audit groups crawlability, redirect, sitemap, and broken link findings. It separates site-wide issues from page-specific fixes.

Security Audit

Critical

v5 • 7/9/2026 Open versioned report

Most static findings are false positives from Markdown examples, placeholders, or documented squirrel CLI usage. Confirmed risks are the curl-to-bash and PowerShell irm-to-iex installer guidance, plus contextual risks around implicit target discovery and untrusted audit output. No prompt injection attempt was found in the skill files.

Files scanned

587

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

Critical

SKILL.md:90

Pipe to shell pattern

curl -fsSL https://squirrelscan.com/install | bash

The skill instructs installation with curl piped directly to bash. This downloads and executes remote code without checksum or signature verification.

Critical

SKILL.md:309

Pipe to shell pattern

1. Install squirrel: `curl -fsSL https://squirrelscan.com/install | bash`

The troubleshooting section repeats the curl to bash installer command. This is still remote code execution from a network source without verification.

Medium

SKILL.md:171-181

Implicit Target Discovery and Live-Site Crawling

The skill tells agents to discover possible audit targets from the local directory, environment variables, memory, or code, then prefer live websites. This can cause unintended audits against external targets unless the user confirms authorization.

The cited lines explicitly describe target discovery and preference for live websites. The risk is contextual because legitimate use is possible after user confirmation.

Medium

references/OUTPUT-FORMAT.md:112-114 references/OUTPUT-FORMAT.md:162-163

Untrusted Audit Output Can Be Piped to AI Agents

The output reference shows piping audit reports directly to an AI agent without warning that website-derived content is untrusted. Page titles, URLs, labels, and metadata can be controlled by audited sites and should not be treated as instructions.

The file documents website-derived metadata and direct piping to an AI agent. The exploitability depends on what site content the CLI includes in reports.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

SKILL.md:309-310

Ruby/shell backtick execution

1. Install squirrel: `curl -fsSL https://squirrelscan.com/install | bash`

This inline command is not Ruby backtick execution, but it is a shell command that pipes a remote installer to bash. The install guidance creates a real remote code execution risk.

Critical

SKILL.md:90

Hardcoded URL

curl -fsSL https://squirrelscan.com/install | bash

The URL is used in a curl command that pipes the downloaded installer into bash. The hardcoded endpoint becomes an executable code source, not a harmless reference.

Critical

SKILL.md:110

Hardcoded URL

irm https://squirrelscan.com/install.ps1 | iex

The URL is used with PowerShell irm piped to iex, which executes the remote installer script. No integrity check or signature validation is shown.

Critical

SKILL.md:309

Hardcoded URL

1. Install squirrel: `curl -fsSL https://squirrelscan.com/install | bash`

The inline troubleshooting command downloads an installer from the hardcoded URL and executes it through bash. This is a real remote code execution install path.

High

SKILL.md:107

PowerShell invocation

Install using PowerShell:

This line introduces a PowerShell installation path, followed by a remote script execution command. The surrounding section makes it real installer guidance rather than inert documentation.

High

SKILL.md:109

PowerShell invocation

```powershell

The PowerShell code block contains a remote installer pattern that executes install.ps1 through iex. That is a high-risk execution workflow even though this line is the fence marker.

Risk Factors

🌐 Network access (33)

⚙️ External commands (50)

SKILL.md:89-91 SKILL.md:91-95 SKILL.md:95-96 SKILL.md:96-97 SKILL.md:97-99 SKILL.md:99-101 SKILL.md:101-103 SKILL.md:103-109 SKILL.md:109-111 SKILL.md:111-115 SKILL.md:115-124 SKILL.md:124-126 SKILL.md:126-130 SKILL.md:130-137 SKILL.md:137-139 SKILL.md:139-143 SKILL.md:143-145 SKILL.md:145-163 SKILL.md:163-165 SKILL.md:165-192 SKILL.md:192-198 SKILL.md:198-204 SKILL.md:204-206 SKILL.md:206-210 SKILL.md:210-212 SKILL.md:212-216 SKILL.md:216-218 SKILL.md:218-222 SKILL.md:222-224 SKILL.md:224-232 SKILL.md:232 SKILL.md:233 SKILL.md:234 SKILL.md:235-236 SKILL.md:236 SKILL.md:237-243 SKILL.md:243 SKILL.md:249-253 SKILL.md:253 SKILL.md:255-257 SKILL.md:257-272 SKILL.md:272-275 SKILL.md:275-279 SKILL.md:279-282 SKILL.md:282-286 SKILL.md:286-289 SKILL.md:289-293 SKILL.md:293-300 SKILL.md:300-309 SKILL.md:309-310

📁 Filesystem access (14)

SKILL.md:95 SKILL.md:96 SKILL.md:97 SKILL.md:99 SKILL.md:149 SKILL.md:318 SKILL.md:95 SKILL.md:96 SKILL.md:97 SKILL.md:99 SKILL.md:102 SKILL.md:149 SKILL.md:310 SKILL.md:318

Detected Patterns

Pipe to shell pattern×2

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/squirrelscan-audit-website/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/squirrelscan-audit-website/security.svg)](https://skillstore.io/skills/squirrelscan-audit-website?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/squirrelscan-audit-website?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/squirrelscan-audit-website/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/squirrelscan-audit-website.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

squirrelscan. (2026). audit-website security audit report (audit version 5) [Author version 1.7]. Skillstore. https://skillstore.io/skills/squirrelscan-audit-website/audits/5

BibTeX citation

@techreport{squirrelscan-squirrelscan-audit-website-2026,
  author = {squirrelscan},
  title = {audit-website security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/squirrelscan-audit-website/audits/5},
  note = {Author version 1.7}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "audit-website security audit report (audit version 5)"
version: "1.7"
type: report
authors:
  - name: "squirrelscan"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/squirrelscan-audit-website/audits/5"
identifiers:
  - type: other
    value: "skillstore:squirrelscan-audit-website:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Developer Site Check

Audit a local or deployed website before release and use the findings to guide code fixes.

SEO Issue Review

Find missing metadata, broken links, crawlability issues, and structured data problems across a site.

Security and Quality Baseline

Review HTTPS, headers, mixed content, leaked secrets patterns, and accessibility issues before handoff.

Try These Prompts

Quick Website Audit

Audit https://example.com with squirrelscan and summarize the top issues I should fix first.

SEO and Link Review

Run a squirrelscan audit for my site and focus on metadata, broken links, crawlability, and sitemap issues.

Recheck After Fixes

Re-audit my website with a fresh crawl and compare the current issues with the previous report.

Deep Remediation Plan

Audit up to 500 pages, group findings by severity, and create a prioritized remediation plan for developers.

Best Practices

Confirm that you are authorized to audit the target website.
Use the LLM report format for concise issue summaries and recommendations.
Review installer commands and filesystem changes before running setup steps.

Avoid

Auditing third-party websites without permission.
Running remote installer scripts without verification.
Treating a crawl report as a full penetration test.

Frequently Asked Questions

What does this skill audit?

It audits SEO, technical health, content quality, accessibility, performance, links, and selected security signals.

Does it require an external tool?

Yes. The squirrel CLI must be installed and available in PATH before audits can run.

Can it audit local development sites?

Yes. It can audit a local server when the site is running and reachable by the CLI.

Can it fix issues automatically?

It reports issues and recommendations. Code changes still depend on the agent, project access, and user approval.

Is it safe to audit any website?

Only audit websites you own or have permission to test. Crawling can create traffic and logs.

Which AI tools are supported?

The skill declares support for Claude, Codex, and Claude Code.

Developer Details

Author

squirrelscan

License

See LICENSE file in repository root

Author version

v1.7

Skillstore revision

Version notice

The author-declared version is not valid SemVer.

Repository

https://github.com/squirrelscan/skills/tree/main/audit-website/

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

12 downloads · 231 views

File structure

📁 references/

📄 OUTPUT-FORMAT.md

📄 README.md

📄 SKILL.md