AI Visibility: Per-Engine Signal Analysis
Fast-path AI visibility analysis using public web signals, with a per-engine proxy map for ChatGPT, Claude, Gemini, Perplexity, Copilot, and Google AI Overviews. Runs in your Claude Code session without an Akii-hosted score or scoring API. Use when the user asks for "AI visibility", "AI visibilit...
Install this skill
or
90/100
Security score
The AI Visibility: Per-Engine Signal Analysis skill was audited on Nov 2, 2026 and we found 2 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
medium line 17
Command substitution pattern
SourceSKILL.md
| 15 | ## Inputs to gather |
| 16 | - **Domain** (required, e.g. `example.com`). Normalize (strip protocol, `www.`, trailing slash, paths) AND validate against `^[a-z0-9][a-z0-9-]*(\.[a-z0-9-]+)+$` before interpolating into any curl. If validation fails, refuse with `error: invalid domain`. Never pass raw user input to a shell command. |
| 17 | - **Brand name** (optional; confirm from public evidence if omitted). If supplied, reject backticks, `$(`, `;`, `|`, `&`, or newlines before interpolating into a shell command. |
| 18 | - **Country / locale** (optional). ISO code only: `^[A-Z]{2}$`. |
| 19 | - **Category + key competitors** (optional). |
medium line 30
Curl to non-GitHub URL
SourceSKILL.md
| 28 | After validating the domain regex, attempt to fetch it once: |
| 29 | ```bash |
| 30 | curl -sI -L --max-time 8 -o /dev/null -w "%{http_code} %{url_effective}\n" "https://<domain>" |
| 31 | ``` |
| 32 | - **200 / 301 / 302 / 308**: reachable. Continue to the signal analysis. |
Scanned on Nov 2, 2026
View Security Dashboard