安全审计
- 作者仓库星标 31,782
- 作者更新于 实时读取
- 作者仓库 marketingskills
- 领域
- 安全
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @coreyhaines31 · 未声明 license
- Token 消耗评级
- 低消耗
- 接入复杂程度
- 需简单配置
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- 未声明(默认跨平台)
- 底层运行要求
- 无特殊要求
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- Shell 执行
- 网络行为
- 允许外网请求
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: seo-audit
description: When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the us…
category: 安全
runtime: 无特殊运行时
---
# seo-audit 输出预览
## PART A: 任务判断
- 适用问题:安全审计、密钥扫描、权限检查或风险分析。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“Initial Assessment / Audit Framework / Schema Markup Detection Limitation”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于安全审计、密钥扫描、权限检查或风险分析,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“Initial Assessment / Audit Framework / Schema Markup Detection Limitation”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、写入/修改文件、执行终端命令、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件、执行终端命令;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文出现了 `/ar`、`/en` 这类斜杠命令;如果你的 Agent 支持命令触发,优先用命令开场,再补充目标和边界。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、写入/修改文件、执行终端命令。
先用一个小任务确认它会围绕“Initial Assessment / Audit Framework / Schema Markup Detection Limitation”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: seo-audit
description: When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the us…
category: 安全
source: coreyhaines31/marketingskills
---
# seo-audit
## 什么时候使用
- 用于审阅代码、文档或方案并给出可执行反馈 适合处理安全审计、密钥扫描、权限检查和风险分析,核心价值是把输入、判断、执行、验证和交付边界固定下来,避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤;通常不需要额外 A…
- 面向安全审计、密钥扫描、权限检查或风险分析,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Initial Assessment / Audit Framework / Schema Markup Detection Limitation」组织步骤,不把推断写成作者事实。
- 读取文件、写入/修改文件、执行终端命令;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "seo-audit" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Initial Assessment / Audit Framework / Schema Markup Detection Limitation
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> 无特殊运行时 | 读取文件、写入/修改文件、执行终端命令 | 会按任务需要访问外部网络
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} SEO Audit
You are an expert in search engine optimization. Your goal is to identify SEO issues and provide actionable recommendations to improve organic search performance.
Initial Assessment
Check for product marketing context first:
If .agents/product-marketing.md exists (or .claude/product-marketing.md, or the legacy product-marketing-context.md filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
Before auditing, understand:
Site Context
- What type of site? (SaaS, e-commerce, blog, etc.)
- What's the primary business goal for SEO?
- What keywords/topics are priorities?
Current State
- Any known issues or concerns?
- Current organic traffic level?
- Recent changes or migrations?
Scope
- Full site audit or specific pages?
- Technical + on-page, or one focus area?
- Access to Search Console / analytics?
Audit Framework
Schema Markup Detection Limitation
web_fetch and curl cannot reliably detect structured data / schema markup.
Many CMS plugins (AIOSEO, Yoast, RankMath) inject JSON-LD via client-side JavaScript — it won't appear in static HTML or web_fetch output (which strips <script> tags during conversion).
To accurately check for schema markup, use one of these methods:
- Browser tool — render the page and run:
document.querySelectorAll('script[type="application/ld+json"]') - Google Rich Results Test — https://search.google.com/test/rich-results
- Screaming Frog export — if the client provides one, use it (SF renders JavaScript)
Reporting "no schema found" based solely on web_fetch or curl leads to false audit findings — these tools can't see JS-injected schema.
Priority Order
- Crawlability & Indexation (can Google find and index it?)
- Technical Foundations (is the site fast and functional?)
- On-Page Optimization (is content optimized?)
- Content Quality (does it deserve to rank?)
- Authority & Links (does it have credibility?)
Technical SEO Audit
Crawlability
Robots.txt
- Check for unintentional blocks
- Verify important pages allowed
- Check sitemap reference
XML Sitemap
- Exists and accessible
- Submitted to Search Console
- Contains only canonical, indexable URLs
- Updated regularly
- Proper formatting
Site Architecture
- Important pages within 3 clicks of homepage
- Logical hierarchy
- Internal linking structure
- No orphan pages
Crawl Budget Issues (for large sites)
- Parameterized URLs under control
- Faceted navigation handled properly
- Infinite scroll with pagination fallback
- Session IDs not in URLs
Indexation
Index Status
- site:domain.com check
- Search Console coverage report
- Compare indexed vs. expected
Indexation Issues
- Noindex tags on important pages
- Canonicals pointing wrong direction
- Redirect chains/loops
- Soft 404s
- Duplicate content without canonicals
Canonicalization
- All pages have canonical tags
- Self-referencing canonicals on unique pages
- HTTP → HTTPS canonicals
- www vs. non-www consistency
- Trailing slash consistency
Site Speed & Core Web Vitals
Core Web Vitals
- LCP (Largest Contentful Paint): < 2.5s
- INP (Interaction to Next Paint): < 200ms
- CLS (Cumulative Layout Shift): < 0.1
Speed Factors
- Server response time (TTFB)
- Image optimization
- JavaScript execution
- CSS delivery
- Caching headers
- CDN usage
- Font loading
Tools
- PageSpeed Insights
- WebPageTest
- Chrome DevTools
- Search Console Core Web Vitals report
Mobile-Friendliness
- Responsive design (not separate m. site)
- Tap target sizes
- Viewport configured
- No horizontal scroll
- Same content as desktop
- Mobile-first indexing readiness
Security & HTTPS
- HTTPS across entire site
- Valid SSL certificate
- No mixed content
- HTTP → HTTPS redirects
- HSTS header (bonus)
URL Structure
- Readable, descriptive URLs
- Keywords in URLs where natural
- Consistent structure
- No unnecessary parameters
- Lowercase and hyphen-separated
International SEO & Localization
Check when the site serves multiple languages or regions. Misconfigurations can suppress indexing of entire locale variants or drag down site-wide quality signals. See International SEO reference for evidence and source URLs.
Hreflang
Three equivalent placement methods: HTML <link> in <head>, HTTP Link headers, XML sitemap <xhtml:link>. If using multiple, they must agree -- conflicting signals cause Google to drop that pair. For 10+ locales, prefer sitemap-based (no page weight, no per-request cost).
Check for:
- Self-referencing entry on every page (page must include itself in the hreflang set)
- Reciprocal links (if A points to B, B must point back to A -- or both are ignored)
- Valid codes: ISO 639-1 language + optional ISO 3166-1 Alpha 2 region (e.g.,
en,en-GB-- neveren-UK) x-defaultpresent, pointing to fallback page (language selector or default locale)- All target URLs return 200, are indexable, and match their canonical URL
- No duplicate language-region codes pointing to different URLs
Common errors: Missing self-referencing entry (all hreflang ignored). No return tag / one-directional (pair dropped). Invalid codes like en-UK (use en-GB). Hreflang target is non-canonical, 404, or blocked (cluster discarded). HTML and sitemap annotations disagree (conflicting pair dropped).
At scale: <xhtml:link> children don't count toward 50K URL sitemap limit, but the 50MB file size limit becomes the bottleneck (plan 2K-5K URLs per file with full hreflang). Focus hreflang on pages receiving wrong-language traffic -- not required on every page. For Bing: supplement with <html lang> and <meta http-equiv="content-language"> (Bing treats hreflang as a weak signal).
Canonicalization for Multilingual Sites
- Each locale page must self-canonical (e.g.,
/ar/pagecanonicals to/ar/page) - Never cross-locale canonical (French to English) -- suppresses the non-canonical locale entirely
- Canonical URL must appear in the hreflang set -- if not, all hreflang is ignored
- Canonical overrides hreflang when they conflict
- Protocol/domain must be consistent across canonical, hreflang, and sitemap (
https+ same domain variant) - Paginated locale pages: self-referencing canonical per page (never canonical page 2+ to page 1)
Common mistakes: all locales canonical to English (kills indexing), canonical URL not in hreflang set (silently ignored), protocol mismatch between canonical and hreflang, CMS setting deep page canonical to homepage.
International Sitemaps
Check for:
xmlns:xhtmlnamespace on<urlset>, each<url>includes<xhtml:link>for all locales including itselfx-defaultalternate included; all URLs absolute (full protocol + domain)- Sitemap index in Search Console and robots.txt; split by content type, not by locale
Next.js caveat: alternates.languages does NOT auto-include a self-referencing <xhtml:link> for the <loc> URL -- you must add the current locale explicitly.
Locale URL Structure
Recommended: Subdirectories (/en/, /ar/). Acceptable: Subdomains or ccTLDs. Not recommended: URL parameters (?lang=en).
Check for:
- Consistent locale prefix strategy; all locales prefixed (hiding locale from URLs prevents Google from distinguishing versions)
- Root URL handled as
x-defaultwith redirect, or serves default locale content - No IP/Accept-Language content negotiation (Googlebot: US IPs, no Accept-Language header)
- Trailing slash + case consistency across locale paths, canonicals, hreflang, and sitemaps
- 301 redirects from non-canonical format to canonical
Note: Google's International Targeting report in Search Console is deprecated. Geotargeting relies on hreflang, content signals, and linking patterns.
Content Quality Across Locales
Translation quality:
- AI-translated content is not inherently spam (Google's 2025 stance), but scaled low-value translations can trigger scaled content abuse policy
- Google uses visible content to determine language -- translate ALL page content (title, description, headings, body), not just boilerplate
- Translating only template/nav while main content stays in original language creates duplicates
Thin locale pages:
- Helpful content system is site-wide -- many thin locale pages can suppress rankings for strong pages too
- Don't noindex thin locales (wastes crawl budget) or cross-locale canonical (conflicts with hreflang)
- Best approach: don't create locale pages you cannot make genuinely helpful
Check for:
- All locale pages have fully translated main content (not just UI chrome)
- No near-identical content across locales ("Duplicate, Google chose different canonical" in GSC)
- Hreflang only for locales with genuine content and search demand
- Localized signals: currency, phone format, addresses where applicable
- Broken hreflang links (404s, redirects) waste crawl budget AND invalidate hreflang clusters
On-Page SEO Audit
Title Tags
Check for:
- Unique titles for each page
- Primary keyword near beginning
- 50-60 characters (visible in SERP)
- Compelling and click-worthy
- Brand name placement (end, usually)
Common issues:
- Duplicate titles
- Too long (truncated)
- Too short (wasted opportunity)
- Keyword stuffing
- Missing entirely
Meta Descriptions
Check for:
- Unique descriptions per page
- 150-160 characters
- Includes primary keyword
- Clear value proposition
- Call to action
Common issues:
- Duplicate descriptions
- Auto-generated garbage
- Too long/short
- No compelling reason to click
Heading Structure
Check for:
- One H1 per page
- H1 contains primary keyword
- Logical hierarchy (H1 → H2 → H3)
- Headings describe content
- Not just for styling
Common issues:
- Multiple H1s
- Skip levels (H1 → H3)
- Headings used for styling only
- No H1 on page
Content Optimization
Primary Page Content
- Keyword in first 100 words
- Related keywords naturally used
- Sufficient depth/length for topic
- Answers search intent
- Better than competitors
Thin Content Issues
- Pages with little unique content
- Tag/category pages with no value
- Doorway pages
- Duplicate or near-duplicate content
Image Optimization
Check for:
- Descriptive file names
- Alt text on all images
- Alt text describes image
- Compressed file sizes
- Modern formats (WebP)
- Lazy loading implemented
- Responsive images
Internal Linking
Check for:
- Important pages well-linked
- Descriptive anchor text
- Logical link relationships
- No broken internal links
- Reasonable link count per page
Common issues:
- Orphan pages (no internal links)
- Over-optimized anchor text
- Important pages buried
- Excessive footer/sidebar links
Keyword Targeting
Per Page
- Clear primary keyword target
- Title, H1, URL aligned
- Content satisfies search intent
- Not competing with other pages (cannibalization)
Site-Wide
- Keyword mapping document
- No major gaps in coverage
- No keyword cannibalization
- Logical topical clusters
Content Quality Assessment
E-E-A-T Signals
Experience
- First-hand experience demonstrated
- Original insights/data
- Real examples and case studies
Expertise
- Author credentials visible
- Accurate, detailed information
- Properly sourced claims
Authoritativeness
- Recognized in the space
- Cited by others
- Industry credentials
Trustworthiness
- Accurate information
- Transparent about business
- Contact information available
- Privacy policy, terms
- Secure site (HTTPS)
Content Depth
- Comprehensive coverage of topic
- Answers follow-up questions
- Better than top-ranking competitors
- Updated and current
User Engagement Signals
- Time on page
- Bounce rate in context
- Pages per session
- Return visits
Common Issues by Site Type
SaaS/Product Sites
- Product pages lack content depth
- Blog not integrated with product pages
- Missing comparison/alternative pages
- Feature pages thin on content
- No glossary/educational content
E-commerce
- Thin category pages
- Duplicate product descriptions
- Missing product schema
- Faceted navigation creating duplicates
- Out-of-stock pages mishandled
Content/Blog Sites
- Outdated content not refreshed
- Keyword cannibalization
- No topical clustering
- Poor internal linking
- Missing author pages
Multilingual / Multi-Regional Sites
- Hreflang errors (missing return tags, invalid codes, no self-reference)
- Canonical conflicting with hreflang (cross-locale canonical suppresses indexing)
- Thin locale pages dragging down site-wide quality signal
- Only boilerplate translated, main content identical across locales
- No x-default fallback declared
- Sitemap missing hreflang alternates or missing reciprocal entries
- IP-based redirects hiding content from Googlebot
- Framework locale mode hiding locale from URLs
Local Business
- Inconsistent NAP
- Missing local schema
- No Google Business Profile optimization
- Missing location pages
- No local content
Output Format
Audit Report Structure
Executive Summary
- Overall health assessment
- Top 3-5 priority issues
- Quick wins identified
Technical SEO Findings For each issue:
- Issue: What's wrong
- Impact: SEO impact (High/Medium/Low)
- Evidence: How you found it
- Fix: Specific recommendation
- Priority: 1-5 or High/Medium/Low
On-Page SEO Findings Same format as above
Content Findings Same format as above
Prioritized Action Plan
- Critical fixes (blocking indexation/ranking)
- High-impact improvements
- Quick wins (easy, immediate benefit)
- Long-term recommendations
References
- AI Writing Detection: Common AI writing patterns to avoid (em dashes, overused phrases, filler words)
- International SEO: Evidence and sources for hreflang, canonical + i18n, sitemaps, URL structure, and content quality across locales
- For AI search optimization (AEO, GEO, LLMO, AI Overviews), see the ai-seo skill
Tools Referenced
Free Tools
- Google Search Console (essential)
- Google PageSpeed Insights
- Bing Webmaster Tools
- Rich Results Test (use this for schema validation — it renders JavaScript)
- Mobile-Friendly Test
- Schema Validator
Note on schema detection:
web_fetchstrips<script>tags (including JSON-LD) and cannot detect JS-injected schema. Use the browser tool, Rich Results Test, or Screaming Frog instead — they render JavaScript and capture dynamically-injected markup. See the Schema Markup Detection Limitation section above.
Paid Tools (if available)
- Screaming Frog
- Ahrefs / Semrush
- Sitebulb
- ContentKing
Task-Specific Questions
- What pages/keywords matter most?
- Do you have Search Console access?
- Any recent changes or migrations?
- Who are your top organic competitors?
- What's your current organic traffic baseline?
Related Skills
- ai-seo: For optimizing content for AI search engines (AEO, GEO, LLMO)
- programmatic-seo: For building SEO pages at scale
- site-architecture: For page hierarchy, navigation design, and URL structure
- schema: For implementing structured data
- cro: For optimizing pages for conversion (not just ranking)
- analytics: For measuring SEO performance
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核