ai-search
When the user wants to make a site readable, accurate and quotable for AI assistants (ChatGPT, Claude, Perplexity, Gemini, Copilot, Google AI Overviews) so they describe the product correctly and cite it. Use when the user says "llms.txt", "llms-full.txt", "AI search", "GEO", "AEO", "get cited by...
Install this skill
or
80/100
Security score
The ai-search skill was audited on Nov 11, 2026 and we found 4 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
medium line 43
Curl to non-GitHub URL
SourceSKILL.md
| 41 | Generate it from the fact sheet and page metadata (a route handler or build script) so a new page appears without hand edits. Serve it with status 200, as `text/plain` or `text/markdown; charset=utf-8`, with no login, redirect or JavaScript. Check: |
| 42 | ```bash |
| 43 | curl -sI https://acme.example/llms.txt | head -5 # 200 and a text content type |
| 44 | curl -s https://acme.example/llms.txt | head -30 |
| 45 | ``` |
medium line 44
Curl to non-GitHub URL
SourceSKILL.md
| 42 | ```bash |
| 43 | curl -sI https://acme.example/llms.txt | head -5 # 200 and a text content type |
| 44 | curl -s https://acme.example/llms.txt | head -30 |
| 45 | ``` |
| 46 |
medium line 90
Curl to non-GitHub URL
SourceSKILL.md
| 88 | A crawler obeys only the group that names it, so a named group must repeat every `Disallow`, or it opens your private paths. robots.txt also can't override the CDN: some offer a "block AI bots" switch that returns 403 whatever robots.txt says. Spot-check, then confirm real crawler hits in the CDN's bot report or server logs (CDNs that verify bot IPs may treat a spoofed User-Agent differently): |
| 89 | ```bash |
| 90 | curl -s -o /dev/null -w '%{http_code}\n' -A 'Mozilla/5.0 (compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)' https://acme.example/pricing |
| 91 | ``` |
| 92 |
medium line 96
Curl to non-GitHub URL
SourceSKILL.md
| 94 | Right under the H1, in server-rendered HTML: "**<Name> is a <category> that <does what> for <whom>.**" The second sentence gives the differentiator. Reuse the same sentence on the home page, in llms.txt, in `Organization.description`, in directory listings and in social bios. A slogan ("Finance, reimagined") gives an assistant nothing to quote. Many AI fetchers don't run JavaScript, so check the raw HTML: |
| 95 | ```bash |
| 96 | curl -s https://acme.example/ | grep -c "is an invoice-matching tool" # expect 1 or more |
| 97 | ``` |
| 98 |
Scanned on Nov 11, 2026
View Security Dashboard