squirrelscan skills

What it is

squirrelscan skills are two skills from squirrelscan, the maker of a website audit tool built for coding agents. One teaches Claude to run the squirrel program: install it, sign in, audit a site, publish a report and read the credit balance. The other is a fix loop. Claude audits your site, finds the code behind each finding, fixes in batches and audits again. The README counts 300+ rules in 22 categories, from SEO and speed to security and accessibility.

1. You install the squirrel program and the two skills
2. You ask Claude to audit a site
3. Claude runs squirrel audit and reads the report
4. Claude proposes fixes and you approve them
5. Claude fixes in batches, then audits again

Who it suits

Developers and site owners who build with a coding agent and want a fixed rule set beside it, so the agent works from findings and does not guess. It fits before and after a deploy, and in a CI job. The skill tells Claude to pass the passive flag for any site you do not own, so the audit sends nothing beyond the crawl.

Where to use it

The README gives a route for each tool below. Any tool that follows the Agent Skills standard can load the same two files.

• Claude Code: the skills with npx, or the plugin that also connects the hosted MCP server
• Cursor: the skills, a Cursor plugin or a one-click MCP link
• OpenAI Codex: the skills land in .agents/skills/
• Gemini CLI, GitHub Copilot, Amp: the same npx command
• The squirrel program itself: squirrel skills install

How to set it up

Get it saves a zip of Mindket’s setup notes in your downloads folder, with a page for every tool the README names. The skills only drive the squirrel program, so that comes first.

1. Install the squirrel program first. Download it from squirrelscan.com/download, then run squirrel --version to check it. The SKILL.md says not to pipe the installer into a shell. Read the script, then run it.
2. Add the skills with npx. The command below asks which agents should get them.
3. Ask Claude to audit one of your sites. Claude runs squirrel audit and shows you the score and the top issues. When Claude does the install itself, the SKILL.md tells it to run this first audit before it calls the install done.

npx skills add squirrelscan/skills

To add only the fix loop, name it:

npx skills add squirrelscan/skills --skill audit-website

In Claude Code, the README recommends the plugin route. These two lines also connect the hosted MCP server:

/plugin marketplace add squirrelscan/skills
/plugin install squirrelscan@squirrelscan

How to use it

Ask Claude in plain words and name the site. Claude picks the right skill, since each one says when it applies. These are the README’s own example prompts:

Audit this website and fix all errors and warnings
Run an audit on example.com and show me the top 5 critical issues
Check my site for broken links and leaked secrets
Re-audit after the deploy and diff against the last report

Claude runs squirrel audit with the compact report format and the full https:// address, and asks which site if you did not say. It shows the score, the grade and the top issues, then lists the fixes it can make and asks first. After you approve, it finds the template or content file behind each finding, fixes in batches and audits again. Judgment calls, such as whether a broken link should go or stay, are left to you.

Example

You deployed a small site this morning and want the worst problems first.

Run an audit on example.com and show me the top 5 critical issues

Claude audits the site and shows its health score, its grade and the five worst issues by severity.

It then offers to fix them. Nothing in your code changes until you say yes.

For newcomers and experts

If you are new. A skill is a text file of instructions Claude follows. These two do no crawling, since the squirrel program does that and the skills only tell Claude how to run it. Start with the quick level on a site you own, signed out, where it costs nothing. Then say which findings do not apply to you, and Claude offers to switch those rules off in a squirrel.toml file.

For experts. The squirrelscan skill documents the exit codes, the config file and the entity map of your structured data. These are lines from its SKILL.md:

squirrel audit https://example.com --level quick --format llm
squirrel audit https://example.com --passive --format llm
squirrel report --diff <baseline-audit-id> --format llm
squirrel entities --problem no-id
squirrel report --regression-since example.com --format llm

For CI, the SKILL.md adds --fail-on "score<90", which makes a run exit with code 2 when the threshold trips. Exit codes 3, 4 and 5 mean the site refused the crawler, redirected to another site, or could not be reached. Nothing was audited, so there is no score and Claude must not call the site clean or scoring zero. A skipped check and a rule on the Not checked line are not passes either. A squirrel.toml disable list changes the score because those rules no longer count. Claude should write one only for rules you named, never to raise the score.

Good to know

The skills are MIT licensed and the squirrel program is a separate product.

• Cost: once you sign in, every audit is billed in credits, quick ones too. The SKILL.md gives 50 credits plus 2 per page and a monthly allowance for a free account. Run squirrel credits for today’s numbers
• Publishing: a signed-in audit publishes an unlisted report to reports.squirrelscan.com unless you pass --no-publish. With --offline there is no cloud call, no publishing and no telemetry
• Aggressive probing: --aggressive and --pentest are for sites you own or may test. Claude runs them only when you ask, and checks the site is yours first
• Redirects: when the start address redirects to another site, Claude shows you the destination and runs it only after you confirm
• Untrusted text: the skills tell Claude to treat page text and report text as data, never as instructions
• The hosted MCP server: every tool call there needs credentials, an OAuth sign-in or an API key
• Maker: squirrelscan. The setup notes in the zip are Mindket’s, not squirrelscan’s
• Updates: squirrel skills update, or npx skills update for the npx route