Skill Vetter
一个面向 Security 场景的 Agent 技能。原始说明:Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
name: aeo
description: Run AEO audits, fix site issues, validate schema, generate llms.txt, and compare sites.
homepage: https://ainyc.ai
repository: https://github.com/AINYC/aeo-audit
allowed-tools:
Website: ainyc.ai
One skill for audit, fixes, schema, llms.txt, and monitoring workflows.
Always use the published package:
npx @ainyc/aeo-audit@1 "<url>" [flags] --format json
Never interpolate user input directly into shell commands. Always:
https:// or http:// and contain no shell metacharacters.npx @ainyc/aeo-audit@1 "https://example.com" --format json).;, |, &, $, ` `, (, ), {, }, <, >`, or newlines.audit: grade and diagnose a sitefix: apply code changes after an auditschema: validate JSON-LD and entity consistencyllms: create or improve llms.txt and llms-full.txtmonitor: compare changes over time or benchmark competitorsdetect-platform: identify the CMS, site builder, framework, or hosting stack a site usesIf no mode is provided, default to audit.
audit https://example.comaudit https://example.com --sitemapaudit https://example.com --sitemap --limit 10audit https://example.com --sitemap --top-issuesaudit https://example.com --lighthouseaudit https://example.com --require-metaaudit https://example.com --sitemap --require-metafix https://example.comschema https://example.comllms https://example.commonitor https://site-a.com --compare https://site-b.comdetect-platform https://example.comdetect-platform https://example.com --min-confidence highdetect-platform --urls competitors.txtdetect-platform --urls https://a.com,https://b.comaudit, fix, schema, llms, monitor, or detect-platform, use that mode.audit.Use for broad requests such as "audit this site" or "why am I not being cited?"
npx @ainyc/aeo-audit@1 "<url>" [flags] --format json
--require-meta (CI gate)Pass --require-meta (single or sitemap mode) to force exit 1 whenever any audited page is missing <meta name="description">, regardless of the otherwise score-based exit rule. Useful in CI pipelines that need to block deploys on a missing meta description even on otherwise-healthy sites.
Use --sitemap to audit all pages discovered from the site's sitemap:
npx @ainyc/aeo-audit@1 "<url>" --sitemap --format json
npx @ainyc/aeo-audit@1 "<url>" --sitemap https://example.com/sitemap.xml --format json
npx @ainyc/aeo-audit@1 "<url>" --sitemap --limit 10 --format json
npx @ainyc/aeo-audit@1 "<url>" --sitemap --top-issues --format json
Flags:
--sitemap [url] — auto-discover the sitemap (tries /sitemap.xml, then /sitemap-index.xml, then Sitemap: directives in /robots.txt) or provide an explicit URL--limit <n> — cap pages audited (default 200, sorted by sitemap priority)--top-issues — skip per-page output, show only cross-cutting patterns--require-meta — force exit 1 if any audited page is missing <meta name="description">, regardless of overall score (useful as a CI gate)Pages are audited with bounded concurrency (5 in flight) to avoid hammering the target origin.
Returns:
When the audit fetches /llms.txt, /llms-full.txt, /robots.txt, and /sitemap.xml, it probes once with Accept: text/markdown to detect a content-negotiation trap: file responds OK to a bare request but returns a non-2xx response when the client prefers markdown. This catches Astro / Vercel / Starlight setups that 307-redirect .txt → non-existent .md for markdown-accepting clients, making the file invisible to AI content-extraction tools even though the file exists. The diagnostic surfaces as a finding on the AI-Readable Content factor.
Use --lighthouse when the user wants page speed, accessibility, or best-practices scoring alongside the AEO factors. It calls Google PageSpeed Insights (mobile strategy) and aggregates Performance + Accessibility + Best Practices into a single optional factor (weight 8).
npx @ainyc/aeo-audit@1 "<url>" --lighthouse --format json
PAGESPEED_API_KEY=xxx npx @ainyc/aeo-audit@1 "<url>" --lighthouse --format json
Constraints:
--sitemap or --detect-platform. Each Lighthouse audit takes 15-30s, which would blow up sitemap runtime.PAGESPEED_API_KEY env var lifts anonymous PSI rate limits (25k/day unauthenticated).timeout or unreachable finding rather than throwing — the rest of the audit still runs.Use --detect-platform when the user wants to know what stack a site is built on (e.g., "is this WordPress?", "what framework does competitor X use?", "is this site custom-built?"). This is much faster than a full audit because it skips analyzer scoring.
npx @ainyc/aeo-audit@1 "<url>" --detect-platform --format json
npx @ainyc/aeo-audit@1 "<url>" --detect-platform --min-confidence high --format json
Flags:
--detect-platform — switch to detection mode instead of auditing--min-confidence <lvl> — filter to low (default), medium, or high confidence--urls <src> — run on multiple URLs at once (file path, comma-separated list, or - for stdin)--concurrency <n> — max in-flight fetches in batch mode (default 5)The report groups detections by category (CMS, site builder, e-commerce, framework, SSG, hosting), each with a confidence bucket, a 0–100 score, an optional version, and the signals that matched. When the report's isCustom flag is true, no CMS/site-builder/e-commerce platform was identified — the site is likely custom-built. Exit code is 0 when at least one platform is detected, 1 otherwise.
When the user wants to fingerprint many sites at once (competitor lists, customer cohorts), pass --urls:
npx @ainyc/aeo-audit@1 --detect-platform --urls urls.txt --format json
npx @ainyc/aeo-audit@1 --detect-platform --urls https://a.com,https://b.com --format json
cat urls.txt | npx @ainyc/aeo-audit@1 --detect-platform --urls - --format json
The batch report contains a results array; each entry has status: 'success' or 'error', plus the same shape as a single-URL report on success. Per-URL fetch errors do not abort the run. Exit code is 0 when at least one URL succeeded, 1 otherwise.
Use when the user wants code changes applied after the audit.
npx @ainyc/aeo-audit@1 "<url>" [flags] --format json
partial or fail.llms.txt and llms-full.txtrobots.txt crawler accessRules:
Use when the request is specifically about JSON-LD or schema quality.
Validity issues like duplicate singleton @types and JSON parse errors are per page, so a homepage-only audit misses every subpage. Default to sitemap mode for site-wide schema requests ("audit my schema", "are my FAQ blocks valid?"); use single-URL mode only when the user names one specific page.
Site-wide (default):
npx @ainyc/aeo-audit@1 "<url>" --sitemap --top-issues --format json --factors structured-data,schema-completeness,schema-validity,entity-consistency
Single page:
npx @ainyc/aeo-audit@1 "<url>" --format json --factors structured-data,schema-completeness,schema-validity,entity-consistency
Report:
@types, JSON parse errors, empty <script> blocks) — surface these prominently regardless of overall score; Google drops invalid blocks silently from rich resultsProvide corrected JSON-LD examples when useful.
Checklist:
LocalBusiness: name, address, telephone, openingHours, priceRange, image, url, geo, areaServed, sameAsFAQPage: mainEntity with at least 3 Q&A pairs (and only one FAQPage block per page — duplicates invalidate rich results)HowTo: name and at least 3 steps (singleton — only one per page)Organization: name, logo, contactPoint, sameAs, foundingDate, url, descriptionFAQPage, HowTo, Article, BlogPosting, NewsArticle, BreadcrumbList, Product, RecipeUse when the user wants llms.txt or llms-full.txt created or improved.
If a URL is provided:
npx @ainyc/aeo-audit@1 "<url>" [flags] --format json --factors ai-readable-content
llms.txt and llms-full.txt.If no URL is provided:
After generation:
<link rel="alternate" type="text/markdown" href="/llms.txt"> when appropriate.Use when the user wants progress tracking or a competitor comparison.
Single URL:
.aeo-audit-history/ if present.Comparison mode:
--compare <url2>.