seo-aeo-auditSAFE

Evidence-first SEO and AEO audits for search, AI citations, indexation, architecture, measurement, and prioritized change plans.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: seo-aeo-audit
description: Use when auditing a website for search and answer-engine visibility, diagnosing traffic or ranking loss, planning what to change, or extracting link-building targets and keywords - "SEO audit" / "сделай SEO-аудит", "technical SEO audit" / "технический аудит сайта", "AEO audit" / "аудит по SEO и AEO", "AI visibility audit", "why did my traffic drop" / "почему упал трафик", "why am I not ranking" / "почему нет позиций", "why doesn't ChatGPT cite us" / "почему нас не цитирует ChatGPT", "indexing issues" / "проверь индексацию", "SEO change plan" / "план правок по SEO", "google core update" / "апдейт гугла", "keywords for linkbuilding" / "ключи для линкбилдинга", "link building brief" / "бриф для линкбилдера". Runs ten evidence-based tracks (access, canonicalization, architecture, intent, content value, extractability/AEO, entity consensus, experience, risk, measurement) and outputs findings, a change plan, and a link-building brief with keyword CSV.
license: MIT
compatibility: Needs network access to fetch the audited site, its robots, sitemaps and SERPs. Bundled scripts need python3 (stdlib only, nothing to pip install). Optional, degraded-without - Google Search Console and PageSpeed Insights credentials (their absence is reported as an evidence gap, never silently) and the Prowl MCP server for bulk third-party data. Read-only toward the audited site. Optional sibling - super-ux, whose ai-tells.md drives the E4b naturalness pass; in-text fallback when absent.
---

# seo-aeo-audit — audit search + answer-engine visibility, then ship a plan

One job: **look at a real site, prove what is wrong with evidence, and hand back
a prioritized plan of changes** that covers classic search (Google, Yandex, Bing)
and answer engines (AI Overviews / AI Mode, ChatGPT, Perplexity, Claude, Copilot,
Gemini, Alice AI).

Not this skill's job: writing the content, building the pages, buying links. It
ends at a verified diagnosis and an executable plan.

## Non-negotiables

1. **Evidence or silence.** Every finding carries: what you observed, where
   (`URL`, `file:line`, report name), the observed value, and the date. Never
   report a finding you did not verify on this site. "Best practice says" is not
   evidence.
2. **Label the evidence tier** of every recommendation (see
   [references/evidence-tiers.md](references/evidence-tiers.md)):
   `CONFIRMED` (documented by the engine or reproduced on this site) ·
   `STUDY` (published multi-site data) · `FIELD` (single-case report) ·
   `HYPOTHESIS`. Never let a HYPOTHESIS out-rank a CONFIRMED blocker.
3. **Diagnose before prescribing.** No fix goes in the plan until its cause is
   located. "Add schema" is not a diagnosis.
4. **Refuse the myth list.** See "Myth guard" below — recommending those wastes
   the client's budget and is a defect, not a nicety.
5. **Never recommend deceptive tactics.** Cloaking, fabricated consensus
   networks, review manipulation, competitor takedown abuse and click-signal
   spoofing stay out of the plan. They appear in this skill only in
   [references/threats-and-defense.md](references/threats-and-defense.md), as
   things to **detect and defend against**.
6. **State what you could not check.** A missing GSC login is a gap in the
   report, not a silent omission.
7. **Never blend measured with assumed.** When one deliverable carries both —
   a link-building CSV always does — a `source` column separates them and the
   volume cells of an unmeasured row stay **blank, not zero**. A `0` reads as
   "measured, no demand"; blank reads as "nobody has checked". The distinction
   matters most in work someone else executes on a budget.
8. **Know each instrument's blind spot, and say it in the output.** Rules 1 and
   7 govern what *you* write; they do not see a tool that blends or omits before
   you ever look. Two arrive constantly. A static fetch cannot see JSON-LD that
   the CMS injects with JavaScript, so "no schema found" is a **false finding**
   on any Yoast/RankMath/AIOSEO site — `scripts/page_audit.py` prints the caveat
   next to every schema inventory, and absence is only reportable after a
   rendering check. GA4 with consent-mode modelling returns observed and
   estimated behaviour **inside one number** — see
   [references/measurement.md](references/measurement.md) J1 for the three
   activation conditions, the visible indicator, and the observed-only fallback.
   The rule generalizes: before an instrument's silence becomes a finding,
   establish that the instrument could have seen the thing at all.

## Step 0 — Detect mode, never ask twice

Inspect first, then act. In order:

1. Read `docs/seo/` (or the path the user names). If a previous audit exists,
   this run is a **re-audit**: diff against it and lead with what changed.
2. Establish what you can reach — live site, staging, `robots.txt`, `sitemap.xml`,
   Search Console / Bing / analytics, a crawl export, server logs, and any MCP
   connected ([Prowl](references/prowl-mcp.md) covers bulk competitive and demand
   data without a per-vendor seat).
   **Test the access, do not assume it.** A connected server is not a working one:
   tiers gate endpoints and tokens carry narrower scopes than the dashboard
   suggests. Probe the one call each source is there for, and record what came
   back — *"connected but returns `Insufficient plan`"* is a finding the next
   audit needs.
3. Pick the scope with the user **only if the answer changes the work**: whole
   site, one template, one question, or a **link-building extraction** — which is
   a deliverable rather than a diagnosis, works with or without Search Console,
   and has its own file ([linkbuilding.md](references/linkbuilding.md)).
4. Report status in three lines — inputs available, inputs missing, scope — then
   start. Suggest exactly one next action at the end of every run.

```bash
python3 "$SKILL_DIR/scripts/preflight.py" --site sc-domain:example.com --origin https://example.com
`

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

declared (5 observation(s))

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (2)

can say "ignore your previous instructions", "run this command" or "add this

full access. Google's Gary Illyes publicly compared mention manipulation for

Gates applied: no_behavioural_pass.