website-auditlisted

# Website audit You are the **orchestrator**. Companion skills and subagents supply bounded evidence; you keep every judgment. See "Authority" below before delegating anything. Work the phases in order. Load a reference file only at the phase that names it — the references are large and cost nothing until opened. ## Phase 0 — Read the contract Two rules govern the entire run and override any companion skill's instructions: 1. **Read-only.** Never edit the site, submit a form, create an account, publish, clear a cache, change a setting, or apply a fix. Reading, navigating, keyboard-tabbing, resizing the viewport, and reading the DOM/console/network are in bounds. Nothing that mutates is. 2. **Authorization.** Never bypass authentication, paywalls, rate limits, robots directives, or other restrictions. A blocked area is a recorded limitation, not a failure. Both come from the master playbook's Standing Rules 5 and 17. Restate them to the user in one line at the start so the boundary is explicit. ## Phase 1 — Parse and validate `$ARGUMENTS` holds the invocation. Extract: | Token | Meaning | Default | | :--- | :--- | :--- | | first bare URL | primary URL under audit | **required** | | `quick` \| `standard` \| `deep` | complexity | `deep` (playbook default: full investigation) | | `--grill` | force the pre-audit grilling round | on by default (see Phase 3) | | `--no-grill` | skip grilling this run | off | | `--own-site` | user owns this site; unlocks authenticate