Open source · MIT · Agent Skill
AEO Audit — an Agent Skill that checks any website the way AI crawlers see it
Ask Claude to audit any URL. It fetches a website the way an AI crawler does — robots.txt, llms.txt, JSON-LD, sitemaps and agentic endpoints — then reports what it verified, what it could not verify, and how to fix each issue.
/plugin marketplace add angeo-dev/skills
/plugin install aeo-audit@angeoWhat it reads
The collector makes one pass over the public surface of a site and hands the result to the skill, which evaluates it against a catalogue of checks with fixed severities — so two runs on the same site produce the same verdict.
Crawler access
robots.txt rules for GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Google-Extended, Applebot-Extended, Bingbot and CCBot, plus X-Robots-Tag headers.
Machine-readable content
llms.txt, llms-full.txt, XML sitemap and sitemap indexes, and whether the primary content exists in served HTML rather than only in JavaScript.
Structured data
JSON-LD validity, entity coverage by page type, and offer completeness — price, currency, availability, GTIN and MPN, return and shipping policy.
Page signals
Canonical, title, meta description, H1 count, language declaration and content freshness — the signals that decide whether a quote can be attributed.
Agentic endpoints
/.well-known/ucp, /.well-known/mcp.json and related discovery files, with the served body validated as JSON rather than inferred from a 200 response.
Platform awareness
When the site runs on Magento 2 or Adobe Commerce, findings come with the admin path or CLI command that fixes them, not generic advice.
What it found on real sites
Before release, the collector was tested against fourteen live websites — single-page apps, news publishers, Shopify storefronts, documentation sites, WordPress and WAF-protected retail. Two results are worth repeating, because they are the kind of thing a checklist misses.
A UCP profile does not always belong to the merchant. Two Shopify storefronts each publish a valid, signed UCP profile at /.well-known/ucp — spec 2026-04-08, two supported versions, keys and all. The merchant did nothing to get it. But the service endpoint inside points at the platform:
"transport": "mcp",
"endpoint": "https://<store>.myshopify.com/api/ucp/mcp"A Magento store running angeo/module-ucp publishes the same profile shape with the endpoint on its own domain and its own signing keys. Both stores “have UCP”. Only one of them controls it. That is the whole merchant-controlled versus platform-mediated argument, in two lines of JSON.
The second finding is less dramatic, but much more common: a 200 response is not evidence a file exists. Single-page apps with catch-all routing return their app shell for every unknown path — the same 6,856 bytes of HTML for /llms.txt, /ai.txt and all six .well-known paths. Any tool checking status codes alone would report an llms.txt that was never written. The skill validates the served content type and parses the body before calling anything present.
What it does not do
Stated plainly, because an audit that overclaims is worth less than no audit.
- No JavaScript execution. The collector reads served HTML, which is close to what a crawler receives. A client-rendered site is reported as appearing client-rendered — not as empty.
- Homepage by default. Other pages are fetched only when you name them. Product and category coverage needs a representative URL from you.
- No claims about ranking. Nobody outside OpenAI, Anthropic, Google and Perplexity knows how those systems choose sources. This reports what is verifiable: access, presence, validity, completeness.
- Presence, not conformance. An agentic endpoint is reported as present or absent. No protocol handshake is performed — for that, use the in-store audit.
- No content-quality analysis. Answer structure, topical coverage and entity consistency are out of scope in 0.1.0.
- Unreachable is not a pass. A 403 or 500 on a signal is reported as unverified, with the status code. One tested retailer serves robots.txt normally and returns 403 for everything else — the honest answer there is “unknown”, not “clean”.
Skill or module?
They overlap deliberately and answer different questions.
| AEO Audit skill | angeo/module-aeo-audit | |
|---|---|---|
| Where it runs | Your Claude session | Inside Magento, on your server |
| Works on | Any website, including a competitor’s | Your own Magento 2 store views |
| Sees | What an external crawler receives | Configuration, file freshness, CrUX field data |
| Install | One command, nothing on the server | Composer, MIT licensed |
| Best for | A first read, or checking someone else’s store | Ongoing measurement and CI gating |
Where the two disagree about a signal, the external view is usually right about what an agent actually experiences — a feed that looks installed from inside can be unreachable from outside.
Fix what it finds
Every failing signal has a free MIT-licensed Magento 2 module behind it. Run the audit first — most stores fail only two or three signals, not all thirteen.
All 13 modules Free web scan Source on GitHub
Frequently asked
Do I need Magento to use it?
No. The skill audits any URL from outside — Shopify, WooCommerce, a documentation site, a static blog. Magento-specific remediation appears only when the site is detected as Magento.
What do I need installed?
Claude Code or Cowork, which is where plugin marketplaces are consumed, and Python 3 for the collector. The collector uses the standard library only — no packages to install. Nothing is installed on the audited site.
Is it really free?
Yes, MIT licensed, source on GitHub. No licence key, no signup, no telemetry, and no data leaves your machine except the requests to the site being audited.
How is this different from the free web scan?
The web scan runs on angeo.dev and returns a score. The skill runs in your own session, so you can ask follow-up questions, point it at specific product pages, and have it explain a finding rather than just report it.
Can it check a competitor’s store?
Yes. Everything it reads is public: robots.txt, llms.txt, sitemap, page HTML and well-known endpoints. It fetches at a normal rate and executes nothing on the target.
Will fixing everything it reports make ChatGPT recommend my store?
No, and anyone promising that is selling something. The skill covers signals a merchant controls — crawler access, structured data, machine-readable content. Whether an assistant then recommends you also depends on price, reviews and third-party coverage that no audit tool can manufacture.
Part of the AI Commerce Optimization suite · Modules · Compatibility · Packagist · GitHub