squirrelscan skills and plugins

Website audits for AI agents: skills, plugins, and MCP in one repo

What is squirrelscan?

squirrelscan is a website audit tool built for AI agents. It crawls a site, analyzes every page against 300+ rules across SEO, performance, security, accessibility, content, and more, and returns a health score plus concrete, fixable issues.

Features:

• 300+ audit rules across 22 categories
• Leaked secrets detection (96 patterns: OpenAI, Anthropic, AWS, Stripe, and more)
• Multiple output formats: console, text, json, markdown, llm, html
• Diff reports for regressions between audits
• LLM-native output for AI-assisted debugging and optimization
• Optimized for CI/CD pipelines and automation

What's in this repo

This repo is the one home of the squirrelscan agent skills and agent plugins. Every install path below reads it; nothing else carries a copy.

Each plugin bundles both skills and the hosted squirrelscan MCP server:

Codex reads each skill's agents/openai.yaml for its display metadata.

manifest.json lists every skill's version and every file in it with its sha256 and size. The squirrel CLI installs and updates the skills from it: it downloads only the files whose hash changed and verifies each one before writing anything.

Prerequisites

All skills drive the squirrel CLI, which must be installed and in PATH.

Install: squirrelscan.com/download

Verify:

squirrel --version

Installing

Pick the path for your tool:

Agent Skills via npx (works everywhere)

npx skills add squirrelscan/skills

Installs both skills (squirrelscan and audit-website) for whichever agents you select: Claude Code, Codex, Cursor, Gemini CLI, Amp, and more. Skills follow the Agent Skills standard, so the same SKILL.md works across tools. To install just one skill:

npx skills add squirrelscan/skills --skill audit-website

Claude Code plugin (recommended for Claude Code)

/plugin marketplace add squirrelscan/skills
/plugin install squirrelscan@squirrelscan

One step installs both skills and connects the hosted squirrelscan MCP server.

Claude Code channel (opt in)

A separate plugin, squirrelscan-channel, runs squirrel channel and pushes cloud audit events into your running session, so your agent can pull the report and fix what it finds. It is not part of the main plugin, so nobody gets a background process they did not ask for.

/plugin install squirrelscan-channel@squirrelscan
claude --channels plugin:squirrelscan-channel@squirrelscan

It needs a CLI release with the channel command, and until squirrelscan is on Anthropic's channel allowlist you need the development flag instead of --channels. Details: plugins/squirrelscan-channel.

Cursor

1. Skills: npx skills add squirrelscan/skills. Cursor reads Agent Skills from .cursor/skills/, .agents/skills/, and their ~/ equivalents (it also picks up ~/.claude/skills/).
2. MCP only, one click: Add squirrelscan MCP to Cursor
3. Plugin (skills + MCP): this repo is a Cursor plugin (.cursor-plugin/). Teams can import it as a team marketplace (Dashboard, Plugins & MCPs, Add Marketplace, Import from Repo), or clone it into ~/.cursor/plugins/local/squirrelscan and reload the window (Cursor docs).

OpenAI Codex

Codex reads skills from .agents/skills/ (project) or ~/.agents/skills/ (global). npx skills add squirrelscan/skills installs there, or clone and symlink the skills/* directories.

From the squirrel CLI

squirrel skills               # what is installed where, against the latest version
squirrel skills install
squirrel skills update

From v0.0.99 the CLI installs the skills itself, from manifest.json, into ~/.claude/skills and ~/.agents/skills (or a repo's own with --project), takes over installs made with npx skills, and keeps them current with its own auto-update. See docs.squirrelscan.com/cli/skills.

Manual

git clone https://github.com/squirrelscan/skills.git

Then copy or symlink skills/squirrelscan and skills/audit-website into your agent's skills directory (make link does this for Claude Code and .agents/skills consumers).

Updates and versions

• Skills carry their own version in SKILL.md (metadata.version). Bump it with every content change.
• Plugins carry a semver version (claude plugin validate --strict and the OpenAI listing both need one). The squirrelscan plugin's version is the squirrelscan skill's metadata.version padded to three parts (skill 1.16 is plugin 1.16.0) in .claude-plugin/plugin.json, .cursor-plugin/plugin.json and plugin.json; marketplace entries carry none. Claude Code treats the version string as the update key, so an install updates only when we bump it: bump the skill version with every skill content change, and the plugin versions move with it (CI fails on drift). Changes that touch only plugin files (MCP config, manifests) need a skill version bump too, or installs will not see them. squirrelscan-channel has its own semver, bumped when that plugin changes. Third-party marketplaces don't auto-update by default: run /plugin marketplace update squirrelscan then /plugin update squirrelscan@squirrelscan, or turn on auto-update for the marketplace in /plugin (Claude Code docs).
• npx installs update with npx skills update, squirrel skills update, or the squirrel CLI's auto-update.

bun run scripts/check-skills.ts (CI runs it on pull requests and on pushes to main) checks that every SKILL.md parses the way installers read it, and that the plugin manifests agree: same name, same description, a version that matches the skill, one MCP endpoint, and a complete OpenAI listing block.

Moving from squirrelscan/squirrelscan

The skills and plugins used to ship from the squirrelscan/squirrelscan repo too. They now ship only from here.

• Claude Code: the old squirrelscan/squirrelscan marketplace now points its plugin at this repo, so it keeps working. Pick up the move with /plugin marketplace update squirrelscan then /plugin update squirrelscan@squirrelscan. To switch marketplaces instead, remove the old one first: both are named squirrelscan, and Claude Code won't add a second marketplace under a name that is already taken. Removing it also uninstalls the plugin, so reinstall it from here:

  /plugin marketplace remove squirrelscan
  /plugin marketplace add squirrelscan/skills
  /plugin install squirrelscan@squirrelscan

• npx skills: from squirrel v0.0.99, squirrel skills install (or squirrel skills update) takes over installs made with npx skills, whichever repo they came from, and removes them from its lock file. Without the CLI: npx skills add squirrelscan/skills -g.
• Cursor plugin: install it from this repo as above. Cursor's marketplace manifests can't point at another repository, so a copy of the old one does not follow the move.

MCP server

The hosted MCP server lives at https://mcp.squirrelscan.com/mcp (streamable-http; OAuth or Authorization: Bearer sq_... API key). A local stdio server is available via squirrel mcp. Docs: docs.squirrelscan.com/developers/mcp

Example prompts

Audit this website and fix all errors and warnings

Run an audit on example.com and show me the top 5 critical issues

Check my site for broken links and leaked secrets

Re-audit after the deploy and diff against the last report

Contributing

Skill and plugin changes land here, and only here. Contributions are welcome! To suggest new skills or improvements:

1. Open an issue to discuss your idea
2. Fork this repository
3. Create a feature branch
4. Submit a pull request

After changing anything under skills/, regenerate the manifest and commit it with the change (CI fails when it is stale):

bun run scripts/manifest.ts

Bump the skill's metadata.version in its SKILL.md too, so installs can tell the versions apart. For squirrelscan also set the plugin version in the three manifests to the same number plus .0 (1.16 becomes 1.16.0); check-skills.ts fails on a mismatch.

All skills follow the Agent Skills Standard.

License

MIT License. See LICENSE file for details.

Learn more: docs.squirrelscan.com | squirrelscan.com