安全审计
- 作者仓库星标 0
- 作者更新于 实时读取
- 作者仓库 skills-registry
- 领域
- 安全
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @tomevault-io · 未声明 license
- Token 消耗评级
- 低消耗
- 接入复杂程度
- 即装即用
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- 未声明(默认跨平台)
- 底层运行要求
- 无特殊要求
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- 网络行为
- 允许外网请求
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: seo-audit
description: Run a full SEO, AEO, and LLM discoverability audit on cc4.marketing Use when this capability is…
category: 安全
runtime: 无特殊运行时
---
# seo-audit 输出预览
## PART A: 任务判断
- 适用问题:安全审计、密钥扫描、权限检查或风险分析。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“Arguments / Instructions / Phase 1: Parallel Page Audits”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于安全审计、密钥扫描、权限检查或风险分析,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“Arguments / Instructions / Phase 1: Parallel Page Audits”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、写入/修改文件、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文出现了 `/seo-audit`、`/blog` 这类斜杠命令;如果你的 Agent 支持命令触发,优先用命令开场,再补充目标和边界。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、写入/修改文件。
先用一个小任务确认它会围绕“Arguments / Instructions / Phase 1: Parallel Page Audits”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: seo-audit
description: Run a full SEO, AEO, and LLM discoverability audit on cc4.marketing Use when this capability is…
category: 安全
source: tomevault-io/skills-registry
---
# seo-audit
## 什么时候使用
- 把安全方向的常用动作沉淀成 Agent 可调用的技能 适合处理安全审计、密钥扫描、权限检查和风险分析,核心价值是把输入、判断、执行、验证和交付边界固定下来,避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤;通常不…
- 面向安全审计、密钥扫描、权限检查或风险分析,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Arguments / Instructions / Phase 1: Parallel Page Audits」组织步骤,不把推断写成作者事实。
- 读取文件、写入/修改文件;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "seo-audit" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Arguments / Instructions / Phase 1: Parallel Page Audits
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> 无特殊运行时 | 读取文件、写入/修改文件 | 会按任务需要访问外部网络
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} /seo-audit — SEO + AEO + LLM Readiness Audit
Run a comprehensive audit of cc4.marketing for search engine optimization, answer engine optimization, and AI/LLM discoverability.
Arguments
/seo-audit — full audit (default)
/seo-audit quick — check only critical items
/seo-audit [url] — audit a specific page (e.g. /seo-audit /blog/my-post)
Instructions
Phase 1: Parallel Page Audits
Launch parallel agents to audit pages. For each page, check:
Meta Tags:
- Title tag (unique, under 60 chars, includes primary keyword)
- Meta description (unique, 150-160 chars, includes CTA)
- Meta keywords (page-specific, not generic defaults)
- Canonical URL (correct, no duplicates)
- robots (index, follow)
Open Graph / Social:
- og:title, og:description, og:image (absolute URL, 1200x630 PNG)
- og:type (website for pages, article for posts/lessons)
- twitter:card (summary_large_image), twitter:image
Structured Data (JSON-LD):
- Homepage: WebSite, Course, BreadcrumbList
- Blog index: CollectionPage (no Course schema, no base BreadcrumbList)
- Blog posts: BlogPosting with headline, description, datePublished, dateModified, author (Person), publisher (Organization with raster logo), mainEntityOfPage, breadcrumb
- Authors: AboutPage with Person schemas
- Lesson pages: should NOT have Course schema duplicated
- Check for duplicate/conflicting BreadcrumbList schemas
Content Quality:
- H1 count (exactly 1 per page)
- Internal links have trailing slashes
- Images have alt text and dimensions
Phase 2: Site-Wide Checks
robots.txt:
- Fetch https://cc4.marketing/robots.txt
- Check if AI bots are allowed: GPTBot, ClaudeBot, Claude-Web, PerplexityBot, Google-Extended
- CRITICAL: Check for Cloudflare managed block prepended before custom rules — this overrides your Allow directives
- Verify sitemap and llms.txt references
llms.txt:
- Fetch https://cc4.marketing/llms.txt
- Follows llms.txt spec (title, blockquote summary, structured sections)
- Covers all site sections: homepage, blog, modules, changelog
- Links to llms-full.txt
llms-full.txt:
- Fetch https://cc4.marketing/llms-full.txt
- Full course structure with all 17 lessons
- Blog section with post URLs
- Changelog API endpoints
Sitemap:
- Fetch https://cc4.marketing/sitemap-index.xml
- All pages included (homepage, blog posts, module lessons, changelog, download, brand-guide, authors)
- Priorities correct (homepage 1.0, blog/download 0.9, modules 0.8-0.9, changelog 0.8)
- No orphaned pages (pages in sitemap that 404)
Phase 3: AEO-Specific Checks
- FAQ schema — do any blog posts have Q&A sections that should use FAQPage?
- HowTo schema — do any blog posts have step-by-step instructions that should use HowTo?
- Featured snippets — are H2/H3 headings phrased as questions for featured snippet targeting?
- Entity clarity — is the Organization entity consistent across all schemas?
- Breadcrumb depth — do all pages have proper breadcrumb chains (Home > Section > Page)?
Phase 4: Report
Output a table:
| Area | Status | Issues |
|-------------------|--------|--------|
| Meta tags | PASS/FAIL | ... |
| OG / Social | PASS/FAIL | ... |
| Structured data | PASS/FAIL | ... |
| robots.txt | PASS/FAIL | ... |
| llms.txt | PASS/FAIL | ... |
| Sitemap | PASS/FAIL | ... |
| AEO readiness | PASS/FAIL | ... |
Then list fixes by priority:
- Critical — blocks indexing or AI discovery
- High — affects SERP appearance or rich results
- Medium — optimization opportunities
- Low — nice-to-have
For each fix, show the exact file and line to change, or the exact code change needed.
Key Files
src/layouts/BaseLayout.astro— global meta tags, JSON-LD schemassrc/pages/blog/[slug].astro— BlogPosting schemasrc/pages/blog/index.astro— CollectionPage schemasrc/pages/blog/authors.astro— AboutPage schemaastro.config.mjs— sitemap config with customPagespublic/robots.txt— bot directivespublic/llms.txt— AI discoverypublic/llms-full.txt— extended AI referencewrangler.jsonc— Cloudflare config
Known Gotchas
- Cloudflare prepends a managed AI bot block to robots.txt at the edge — your
public/robots.txtAllow rules get overridden. Fix in Cloudflare Dashboard > Security > Bots > AI Bots. - Blog posts are SSR from Emdash CMS — they must be manually added to
customPagesin the sitemap config. - The
showCourseSchemaandshowBreadcrumbprops on BaseLayout control which pages get Course/BreadcrumbList schemas.
Source: cc4-marketing/site — distributed by TomeVault.
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核