website-scorecard SKILL.md skillA
website-scorecard from karero/croftweaver is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add karero/croftweaver/website-scorecard@git:20261012.a713a36Pins git:20261012.a713a36 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- karero/croftweaver
- Path
skills/website-scorecard/SKILL.md- Versions recorded
- 3
- Latest version
- git:20261012.a713a36, committed Oct 12, 2026
- First version recorded
- Oct 4, 2026
- Size
- 8,714 bytes
- Repository stars
- 8
- License
- MIT
OPTIONAL public scorecard: publish what a site's own test gate checked, as a dated section on one page. `npm run scorecard` runs the whole suite and writes scorecard.json (checks passed per area, pages, date, tested version); a component renders it and tells the reader when the site was edited after the run. The owner can add the four Lighthouse scores of a PageSpeed run, with a re-run link. A red run writes nothing, so a card never shows a failed run as passed. Never runs unasked: publishing…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Website scorecard A site built with this kit carries a test gate. This skill lets the owner **show** what it found: one section on one page, generated from a real test run, dated, and honest about its age. It is optional and it is the owner's decision. Never add it unasked: a public page that reports on the site's quality is a statement the owner makes. ## The offer (what to say to the owner) Say it in the owner's language, in plain words: > Your site comes with automatic checks: accessibility, links, search data, wording > and more. I can add a short "Quality checks" section to one page that shows the > results of a run, with the date and the version they were measured on. If you have > run Google's PageSpeed test on the live site, its four scores go next to it, with a > link so any visitor can run the same test. If the site is edited later, the section > says so by itself until we run the checks again. Do you want that, and on which page? Options: **Yes, on `<page>`** / **No (default)**. No answer means no. ## 0. When it runs - Only when the owner asks, or says yes to the offer above. `new-website` copies this …
Read the whole file at its exact version.
How to install
mdr add karero/croftweaver/website-scorecard@sha256:96641ac27286efd3The line at the top of this page pins the label git:20261012.a713a36, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_7c3wmnkhr3dhetfc)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Oct 4, 2026 and Oct 12, 2026, about one every 4 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261012.a713a36 latest | 2026-10-12 | a713a36 | 8,714 B | A | view · diff |
| git:20261004.28f4d65 | 2026-10-04 | 28f4d65 | 8,730 B | A | view · diff |
| git:20261004.21090dc | 2026-10-04 | 21090dc | 7,699 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (8714 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
karero/croftweaver · 8 stars · license MIT · pushed 2026-10-21 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_7c3wmnkhr3dhetfc GET https://markdownregistry.com/api/v1/resolve?ref=karero/croftweaver/website-scorecard GET https://markdownregistry.com/api/v1/blob/96641ac27286efd3ea88976f4f0af3ec88dcc669c2699d2b1f2a84eb3996b242
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.