VantageWebsite Audit Report Generator

Vantage checks a small business homepage and turns it into a branded, plain-language report with a score and a "fix these first" list. It's the kind of free audit a web consultant hands a prospect to start a conversation: "your site doesn't fit phones, isn't secure, and has no headline saying what you do." The whole point is that the report stays honest about what it actually checked.

"Above the fold" is a heuristic (the first call to action within about 700 characters of visible text), since nothing renders in a real browser. Image weight and load time are estimated, not measured. Like every build in the sprint, the Claude API was never called live, so the optional summary is only tested through its validator. It's a working lead magnet, not a hardened audit service.

This was one of the Claude Cowork builds. My direction was simple: one-shot all the Cowork projects. For this one I gave the spec: a URL or pasted HTML, a server-side fetch with safety limits, a DOM-free scanner, seven check areas, weighted scores, a plain-language fix list, a branded printable report, two fixtures, a sample PDF, an optional Claude summary, and a Cowork skill.

Claude Cowork specced, built, tested, screenshotted, and documented it in one autonomous pass, in about 0.8 hours. That's the core and scanner, 31 checks with owner-facing wording, two fictional fixture sites (a weak auto detailer that scores 41 and a decent bakery in the 90s), a 230-assertion test file, the fetch guard, the page, a print stylesheet, sample PDFs, and a SKILL.md for running the same audit on a real prospect with read-only fetching and draft-only email. Setting up in Cowork felt super fast to me, honestly faster than setting up a Claude Code build. Cowork also picked sensible defaults and wrote them into the report's method note: a placeholder brand, a stated "above the fold" heuristic, and "Not checked" for anything it couldn't measure.

• A regex tag scanner needs a raw-text mode for script, style, textarea, and title. Without it, a "</div>" inside a script or an SVG <title> in the body gets read as page structure, and the page title comes out wrong.
• "Not checked" has to leave the denominator at both the check and the category level. Pasted HTML has no headers, so security drops out of the weighting instead of dragging a decent site down to a D.
• URL validation alone is not an SSRF guard. http://2130706433/ and [::ffff:127.0.0.1] both parse as valid URLs pointing at loopback, and a public name can resolve or redirect to a private address. The server resolves DNS and re-validates on every redirect hop.
• The file-writing step turned my em dash escapes into literal em dashes. A shipped-files assertion in verify.mjs is what caught it.

The same audit.js is imported by the page, the tests, and the server, which is the "shipped code is the tested code" pattern from my early builds applied to a third consumer. The server uses the core's own validateFetchUrl and isPrivateAddress, so the SSRF rules the tests cover are the rules that ship. The optional Claude summary goes through the same validateSummary as the local one.

I'd add an optional headless-browser pass behind the same fetch guard so fold, image weight, and load time are measured, plus a multi-page mode. A saved-prospects list would let a consultant re-run the audit after fixes and send a before-and-after report.