菜单
Audit a web page's SEO metadata, indexing surface, and deployment hygiene — title/meta/OG/canonical/structured data, robots.txt and sitemap.xml, security response headers, and observability/rollback readiness — without publishing anything. Use when asked to check "is this page/seo/release-ready?"
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Abd0r/porcupineai --skill seo-and-deployment命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | seo-and-deployment |
| description | Audit a web page's SEO metadata, indexing surface, and deployment hygiene — title/meta/OG/canonical/structured data, robots.txt and sitemap.xml, security response headers, and observability/rollback readiness — without publishing anything. Use when asked to check "is this page/seo/release-ready?" |
| stack | webdev |
Pre-release readiness audit for a web deployment: the discoverability layer (metadata + indexed surface) and the deploy hygiene layer (security headers, observability, rollback plan). Uses existing shell/web/browser tooling only — reads HTTP responses and rendered head — and never pushes code or triggers a deploy.
browser-qa), or perf metrics (use web-performance).Rendered head. Navigate the page with the browser tools, then use browser_evaluate to read the <head> (title, canonical, robots meta, description, OG/Twitter tags) and the first few heading levels. Note missing/duplicate/empty values.
Metadata checklist. Verify:
<title> that matches the page purpose. Do not enforce folklore character counts as a correctness rule.og:title, og:description, og:image, and any platform-specific tags) with resolvable absolute URLs.Semantic structure. Confirm a clear primary heading and logical document landmarks. This improves machine understanding and accessibility without treating heading shape as a guaranteed ranking factor.
Indexing surface. Check robots.txt, robots meta / X-Robots-Tag, and sitemap.xml when the site uses one:
robots.txt controls crawling, not guaranteed de-indexing.noindex; pages intentionally private or duplicate do.Bare-URL HTTP probe. Use curl/web_extract to confirm the non-www→www and http→https redirects behave and the canonical host is the one you crawled.
Security response headers. For the production URL, read final HTTPS response headers and assess what the application needs:
Content-Security-Policy, including frame-ancestors when framing must be controlled.Strict-Transport-Security with a deliberate scope and duration; only add includeSubDomains when every subdomain is HTTPS-ready.X-Content-Type-Options: nosniff, an appropriate Referrer-Policy, and a least-privilege Permissions-Policy where supported.Cache-Control suitable for personalized HTML versus content-addressed immutable assets.TLS/HTTPS. Confirm the endpoint serves HTTPS (with a valid cert) and redirects plain HTTP; note any mixed-content flagged earlier in browser-qa.
Observability. Confirm the stack exposes, for the page: request logs/APIs (status, latency), error tracking (runtime JS + server 5xx), and at least one health/readiness endpoint. If the user has monitoring/alerts configured, verify the page/host is covered.
Rollback readiness. Establish the deploy/rollback mechanism from the team's practice (CI/CD pipeline, image tag/commit SHA pinned, DB schema compatible forward/backward, feature flags). You do not run a deploy or rollback — you verify that a rollback is possible and fast: can they redeploy the previous artifact, and does the current release carry enough (logs/metrics, feature flags, DB migration plan) to detect and recover a bad one?
Report. Give a checklist table: item → status (pass/warn/fail) → evidence (header/value/selector/URL). Group into SEO & Index and Deployment Hygiene. Explicitly separate "verified now" from "assumed/pre-existing config" for anything like CDN rules you cannot read from this origin.
robots check on www when search uses the bare domain (or vice versa) gives a false pass. Crawl the canonical host and confirm redirects.noindex or a restrictive staging robots.txt may be intentional; state the tier and compare it with that environment's policy.curl -sI over plaintext may return a redirect instead of headers; follow to HTTPS (-L) and read the final response.max-age=0 HSTS is still a warn, not a pass.robots.txt line, or sitemap entry), not an assumption.robots/sitemap misconfigurations, and absent security headers are surfaced as explicit warns/blocks.curl -sI, browser_evaluate, web_extract) so the audit is reproducible.