seo-bootstrap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited seo-bootstrap (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Most solo founders ship a marketing site without a sitemap, without robots.txt, with no Open Graph image, and zero structured data. Google can crawl the site but doesn't know what it is. AI search engines (ChatGPT, Perplexity, Google AI Overviews) skip it entirely because there's nothing structured to cite [1][2].
This skill ships the four files that move a site from "invisible" to "indexable" in one commit: sitemap.xml, robots.txt, a default 1200×630 OG image, and Organization + WebSite JSON-LD in the root layout.
Activation moment: "It opened a PR that fixed sitemap, robots, and schema in one commit."
site:domain.com but no rich result, no favicon in SERP, no OG card on Twitter/iMessageDon't use for: sites that already have all four pieces (run auditing-technical-seo instead), or staging environments that should stay noindex.
Run the detector. Do not eyeball this.
node scripts/detect-framework.js . # human-readable report
node scripts/detect-framework.js . --json # same facts as JSONIt reads package.json plus the folder shape, and returns the framework, the template directory to use, the canonical site URL (and where it came from), and a present/missing verdict for all four assets at framework-idiomatic paths. Exit 0 = framework detected, 1 = unknown, 2 = bad path.
Show the user the report table before writing anything.
framework | Meaning | templates |
|---|---|---|
nextjs-app | next in deps + app/ (wins if both routers present) | templates/nextjs/ |
nextjs-pages | next in deps + pages/ only | templates/nextjs/ (see pages-router-notes.md) |
astro | astro in deps | templates/astro/ |
sveltekit | @sveltejs/kit in deps (dev or prod) | templates/sveltekit/ |
vite-react-router | react-router-dom, no meta-framework | none — static public/ files |
unknown | no package.json, or no supported framework | none — ask the user |
The canonical site URL is a hard gate. The detector reports it from site: (astro.config.*), metadataBase (next.config.* / app/layout.*), or PUBLIC_SITE_URL (svelte.config.*). If it comes back null, ask the user once and do not generate until you have it — without it every sitemap and canonical URL renders relative and Google rejects the file.
If missing comes back empty, stop: the site is already bootstrapped. Route to auditing-technical-seo instead.
Detection lives in code, not in this table, so it is unit-tested against real project fixtures (fixtures/, test/detect-framework.test.js) and cannot drift from what the templates actually support.
Use the framework templates in templates/{nextjs,astro,sveltekit}/ — the detector's templates field names the right one. Each directory has a README mapping template file to destination path. Rules:
REPLACE-WITH-* token before committing. A shipped REPLACE-WITH-CANONICAL-ORIGIN is worse than no sitemap.@astrojs/sitemap to astro.config.* and run npm install. For SvelteKit, the +server.ts is auto-routed.Article/Product schema is the next skill's job.feat(seo): bootstrap sitemap, robots, OG, and JSON-LD. Then open one PR.After deploy (or npm run build && npm run preview):
curl -sI https://site.com/sitemap.xml | head -1 # expect 200
curl -s https://site.com/robots.txt # expect Sitemap: line
curl -sI https://site.com/og.png # expect 200, < 1MBThen:
Organization + WebSite parse with zero errors./admin, /api, draft slugs). Filter explicitly in the generator./api/ and /admin/.next/og ImageResponse template stays well under.noindex after generation./about instead of https://site.com/about — Google rejects.| File | What it does | Why for Google | Why for AI search (GEO) |
|---|---|---|---|
sitemap.xml | Lists every indexable URL + lastmod | Faster, more complete crawl | LLM crawlers (GPTBot, PerplexityBot) use it the same way |
robots.txt | Crawler rules + sitemap pointer | Avoid wasted crawl budget on /api/ | Tells AI crawlers where the sitemap lives |
| OG image | Social card preview | Indirect (CTR signal from social) | LLMs surface the image in answers when present |
JSON-LD Organization + WebSite | Knowledge-graph entity, sitelinks search box | Eligible for rich results | LLMs cite structured entities ~2× more than unstructured text |
After bootstrap merges:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.