Site Evaluation — Security skill for Claude Code

site-evaluation

A [Claude Code](https://claude.com/claude-code) skill for evaluating a live website you do not own, without touching it in any way an ordinary visitor would not.

It covers eight axes, keeps a hard line between passive review and active security testing, and produces a page-break-verified PDF report in Arabic (RTL, Cairo) or English.

What it does

Axis	Examples of what it surfaces
Content and language	advertised counts vs the sitemap, real vs machine translation, Arabic numeral agreement
Accessibility	contrast in both themes, touch-target sizes, label association, landmarks
UX and information architecture	nav drift between page types, fixed overlays colliding with text, responsive clipping
SEO and indexability	canonical/hreflang reciprocity, x-default, Open Graph per page type, sitemap freshness
Performance and caching	public HTML served no-store, compression, render-blocking assets
Security and infrastructure	headers, DNS, TLS versions, CAA, DNSSEC, origin exposure behind a CDN
Email authentication	SPF lookup budget, DMARC report destination, MTA-STS, why DKIM often cannot be determined
Privacy and compliance	policy claims vs observed behaviour, data minimisation, cookie disclosure

What it will not do

It never sends attack payloads, never tests whether a WAF actually blocks anything, never probes for injection, and never touches authenticated areas. Those need written authorization from the site's owner and a different methodology.

The distinction matters and the skill makes it explicit: passive review answers *"what protection is in place?"*, not *"what protection is effective?"*. Every report states what was not tested, because a reader who sees a security chapter otherwise assumes the site is secure.

Layout

SKILL.md                     the methodology: scope boundary, fan-out, verification, severity
references/
  axes.md                    per-axis checks, c