一键在 Manus 中运行任何 Skill

web-launch-check

星标5

分支0

更新时间2026年5月2日 17:30

Pre-launch audit for any website. Verifies privacy policy, ToS, cookie consent, sessions, sitemap, robots.txt, SEO meta tags, structured data, accessibility (WCAG AA), Core Web Vitals, and compliance frameworks (GDPR/CCPA). Returns severity-graded findings with a GO / NO-GO verdict.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

viknesh20-20

viknesh20-20/claude-code-tool-kit

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

/web-launch-check

Run this before any production website launch to catch missing legal pages, broken SEO, accessibility violations, or compliance gaps that would expose the user to legal risk or hurt search ranking.

When to use

Before pushing a marketing site, landing page, or web app to production.
After a major redesign that changed page structure, routes, or third-party integrations.
Before adding analytics or tracking scripts.
When taking over an existing site to assess current state.

What it checks

Layer 1 — Legal pages (CRITICAL — block launch)

Page	Path checked	Required when
Privacy Policy	`/privacy`, `/privacy-policy`, footer link	Always (any data collection, including cookies/IP)
Terms of Service	`/terms`, `/tos`, `/terms-of-service`	Any signup, transaction, or user-generated content
Cookie Policy	`/cookies`, section in `/privacy`	EU/UK visitors, or any non-essential cookies
Contact / Address	`/contact`, footer	EU jurisdictions (Impressum, EU consumer law); always recommended
Refund / Cancellation	`/refunds`, `/cancellation`	Any e-commerce or paid product

Layer 2 — Consent & tracking (HIGH)

Cookie consent banner present before any non-essential cookie is set.
Reject button as prominent as Accept.
Tracking scripts (Google Analytics, Meta Pixel, etc.) blocked until consent.
"Do Not Sell or Share" link if California users (CCPA/CPRA).
Global Privacy Control signal honored.

Layer 3 — Sessions & auth (HIGH)

Cookies have Secure, HttpOnly, SameSite=Lax (or Strict).
Auth tokens not in localStorage if long-lived.
Logout invalidates session server-side.
CSRF protection on state-changing requests.
Session expiry explicit; idle timeout for sensitive flows.

Layer 4 — SEO essentials (HIGH)

Every page has unique <title> (≤ 60 chars).
Every page has unique <meta name="description"> (~150 chars).
Every page has <link rel="canonical">.
Every page has Open Graph tags (og:title, og:description, og:image, og:url, og:type).
Every page has Twitter Card tags.
Structured data (JSON-LD) where relevant (Organization, Article, Product, BreadcrumbList, FAQ).
<html lang> set.
Exactly one <h1> per page; heading hierarchy correct.
Alt text on every meaningful image.

Layer 5 — Site-wide SEO files (HIGH)

robots.txt at root with explicit rules and sitemap reference.
sitemap.xml at root, all canonical URLs, lastmod dates.
/.well-known/security.txt (recommended).
404 page returns HTTP 404.
500 page exists for server errors.

Layer 6 — Performance / Core Web Vitals (HIGH)

LCP ≤ 2.5s on 75th percentile mobile.
INP ≤ 200ms.
CLS ≤ 0.1.
Total blocking JS ≤ 250 KB gzipped (or justified).

Layer 7 — Accessibility (WCAG 2.1 AA) (HIGH)

Keyboard reachable everywhere.
Focus visible.
Color contrast ≥ 4.5:1 (text), ≥ 3:1 (large text and UI).
Form labels associated.
Error messages with aria-describedby.
prefers-reduced-motion respected.
Skip-to-content link present.

Layer 8 — Compliance frameworks (situational)

GDPR (EU users): lawful basis documented, DSAR endpoint, 72-hour breach notification plan.
CCPA/CPRA (California): "Do Not Sell or Share" link.
HIPAA (health data): BAAs with vendors, encryption verified.
PCI-DSS (cards): no raw card numbers handled; tokenization via Stripe/Adyen.

Layer 9 — Forms & PII (HIGH)

HTTPS-only.
Server-side validation on every form.
Rate limiting on signup, login, contact, password reset.
CAPTCHA on public forms.
No PII echoed in URLs (?email=...).
Email verification before privileged actions.

Layer 10 — Email deliverability (MEDIUM, if applicable)

DMARC / DKIM / SPF set up.
Unsubscribe link in every marketing email.
Physical address in marketing email footer (CAN-SPAM).

How the check runs

Detect the framework (Next.js, Astro, SvelteKit, Nuxt, plain HTML, etc.) by reading the project structure.
Walk the routes / pages — collect what exists and what's referenced.
Read the build output if available; otherwise inspect source.
Check each layer above; mark each finding Critical | High | Medium | Low | Pass.
Suggest a fix snippet for each failure.

Output format

## Verdict: GO | CONDITIONAL (fix Critical + High) | NO-GO

## Executive summary
2–3 sentences. Most important risk first.

## Findings by layer

### Layer 1 — Legal pages
- [Critical] /privacy missing — add a route and a stub policy.
- [High]    /terms missing — needed because there's a signup form at /signup.

### Layer 4 — SEO essentials
- [High]    No <meta name="description"> on /pricing, /features, /blog/*.
- [Medium]  Open Graph tags missing site-wide.

### Layer 7 — Accessibility
- [High]    Color contrast 3.2:1 on primary CTA — needs ≥ 4.5:1.
…

## Quick wins
3–5 items the user can ship in one PR.

## Defer-with-issue
Items not blocking launch but tracked.

Do / don't

Do:

Always check every layer. Don't skip layers because the project "is just a landing page."
Cite the exact file and line for each finding.
Provide a fix snippet for every High and Critical finding.

Don't:

Don't let style/preference issues block the verdict — only Critical and High block.
Don't recommend frameworks; work with what's there.
Don't paste full legal text — point to templates (see /legal-pages skill).

同仓库更多 Skills

同仓库

a11y-audit

viknesh20-20/claude-code-tool-kit

Accessibility audit of UI code or a running site against WCAG 2.1 AA. Walks every WCAG criterion that maps to common patterns: keyboard reach, focus visibility, contrast, semantic HTML, ARIA, labels, alt text, motion, screen-reader sense. Severity-graded with code fixes.

2026-05-025

business-blueprint

viknesh20-20/claude-code-tool-kit

Comprehensive business-logic blueprint for SaaS, ERP, e-commerce, and marketplace applications. Walks through every domain (auth, billing, multi-tenancy, inventory, audit, compliance, etc.), surfaces the edge cases that actually break in production, and proposes a concrete plan tailored to the user's context.

2026-05-025

business-logic-audit

viknesh20-20/claude-code-tool-kit

Reviews existing business code (billing, multi-tenancy, state machines, inventory, GL postings, audit logs, etc.) for missing real-world edge cases. Severity-graded findings — invariant violations, race conditions, missing idempotency, currency precision bugs, audit gaps, jurisdiction issues.

2026-05-025

competitive-analysis

viknesh20-20/claude-code-tool-kit

Research how 2–4 mature competitors solve a specific business problem (billing, RBAC, search, onboarding, multi-tenancy, etc.) and produce a side-by-side comparison so the team can pick the right approach for their context. Uses web search + scraping; cites every source.

2026-05-025

design-flow

viknesh20-20/claude-code-tool-kit

Designs an end-to-end user flow before any pixels are drawn — entry point, screens, decisions, branches, error/recovery paths, edge cases, microcopy hooks. Outputs a structured spec engineering and design can build from.

2026-05-025

microcopy

viknesh20-20/claude-code-tool-kit

Writes or reviews UX copy — button labels, error messages, empty states, success messages, tooltips, form labels, onboarding text, confirmation dialogs. Voice-consistent, action-led, recovery-oriented. Localizable. No dark patterns.

2026-05-025

name	web-launch-check
description	Pre-launch audit for any website. Verifies privacy policy, ToS, cookie consent, sessions, sitemap, robots.txt, SEO meta tags, structured data, accessibility (WCAG AA), Core Web Vitals, and compliance frameworks (GDPR/CCPA). Returns severity-graded findings with a GO / NO-GO verdict.