Kai Audit

Kai root note: knowledge/, harness/, and scripts/ paths in this skill live in the Kai install, not the user's project. Resolve them against the first ancestor directory of this SKILL.md that contains a knowledge/ folder (the Kai plugin root, ~/.claude/kai, or the kai-cmo-harness repo). MARKETING.md, memory/, and any output files live in the current project. If a referenced scripts/ command is not available in this install, say so, skip it, and continue with the file-based guidance — never fabricate its output.

/kai-audit — A Sourced Read On What Is Actually Broken

Objective

A full marketing health report for one business: every applicable harness checklist run against the real site and the real channels, a health score per module that only counts measured findings, and one prioritized fix list that routes each fix to the skill or action that resolves it. Every number in it traces to a collector source someone else can re-pull.

An audit's value is entirely in the sourcing. A score built on estimates is worse than no score, because it gets quoted.

Done when

Work type audit-report — floor E3/C4/O1 (harness/eco-floors.yaml), client_facing: true.

• E3 — the delivered file is the approved, hash-pinned version, and every quantitative claim resolves to a collector source in workspace/marketing-audit/.
• C4 — the Kai Data Provenance Rule, in full: the collector ran before writing, the mode is declared, every number cites a source, missing data sits in _data-gaps.md, and python scripts/quality_gates/audit_provenance_lint.py workspace/marketing-audit --audit-dir passes. Plus banned_word_check. C4 is not a lint pass — it is the field standard for client-facing analysis.
• O1 — every P0 fix names the metric it targets, its baseline, and an owner. The audit's own outcome, read at 60 days, is whether its recommendations were accepted and implemented.

Constraints

Provenance — non-negotiable

Load harness/references/audit-data-provenance.md before writing any finding. Declare exactly one mode:

Default to sales_external when access is unclear.

1. No number without a source. Review counts, ratings, rankings, traffic, conversions, calls, Core Web Vitals, Domain Rating, referring domains, AI Overview visibility, and local pack placement each need a source, a retrieval date, and an artifact or API note.
2. Do not score what was not measured. Missing GSC, GA4, GBP, call tracking, backlink, or ad-platform data is a data gap, never an invented estimate.
3. Do not turn inference into fact. Hypotheses are labeled score_eligible: false and stay out of client-facing health scores.
4. Do not cite a tool that did not run. If the report names Ahrefs, DataForSEO, PageSpeed Insights, BuiltWith, Google Places, GSC, GA4, GBP, CallRail, or a CRM, it includes the retrieval date and the raw artifact path or response summary.
5. Every deck slide with a number needs a source footer. Every audit folder needs _data-sources.md and _data-gaps.md.

Collector before writing

python -m scripts.audit.collect --url "<url>" --firm-name "<firm_name>" --mode sales_external --workflow audit --out workspace/marketing-audit --pagespeed

Use --mode onboarding_connected only when the client granted private access, and add optional collectors only for facts the audit actually needs: --places --dataforseo --seo-provider auto --gsc --ga4 --calls --keywords "<kw1>,<kw2>" --location "<city, state>" --date-from "<YYYY-MM-DD>" --date-to "<YYYY-MM-DD>". Add --third-party-sources all or a comma list (serpapi,similarweb,builtwith,wappalyzer,brightlocal,yext,yelp,trustpilot,google-ads,meta-ads,tiktok-ads,linkedin-ads,twilio) when licensed vendor data is needed — API vendor values are third_party_estimate, supplied exports are user_provided.

The collector writes kai-data.json, audit-data.json, _data-sources.md, _data-gaps.md, and raw/ under workspace/marketing-audit/. All findings, health scores, and deck numbers come from audit-data.json. Not from conversation, not from snippets, not from model memory. A metric absent from audit-data.json becomes a data gap. Missing credentials stay data gaps until the collector records a sourced metric.

The collector is shared across Kai workflows; this audit consumes the audit-data.json alias. Existing audit automations may keep using python -m scripts.audit.collect; non-audit workflows prefer python -m kai.source_data.collect and read kai-data.json.

If the collector scripts are not in this install (skills-only or plugin install, no scripts/audit/), run in qualitative mode: browse the target's public pages directly, cite URL and retrieval date for every observation, put every unmeasurable quantitative claim in _data-gaps.md, and state plainly in the report header that collector-backed metrics require the full harness (github.com/cgallic/kai-cmo-harness). Never estimate a number the collector would have measured.

Everything else

• Read MARKETING.md from the project root first. If it does not exist, build it from the codebase — CLAUDE.md, README.md, PROJECT.md, package.json, landing pages, email/ad/analytics config — using the template from /kai-email-system, and confirm the draft. Do not ask the user what the product is.
• Eight things must be known before scoping: what is being audited; the main URL; which channels are active; known issues already flagged; depth (quick top-line scores, ~30 min, or deep detailed findings, 2–3 hours); the audit mode; which data access exists; and the business type.
• Every check gets a provenance record: claim, source_tier (connected | public_observed | user_provided | inferred | missing_data), source_name, source_url, retrieved_at, confidence (high/medium/low), evidence_artifact, score_eligible. Only connected, public_observed, and user_provided findings affect health scores. inferred and missing_data are scope notes unless the user explicitly asks for internal hypotheses.
• Phone lead capture is evaluated for every business, via the Phone-Based Lead Capture section of cro-audit-checklist.md. KaiCalls is Kai-owned: disclose the relationship, compare alternatives, and recommend it only when missed-call, after-hours, speed-to-lead, qualification, routing, or call-logging evidence supports it.
• Skip checklists for channels the business does not use. An empty module scored zero is a fabricated finding.

Context

Business type drives which industry module loads. A business can match several — a multi-location dental practice triggers both Multi-Location and Healthcare. Load all that apply.

Audit modules:

Industry modules from the business-type table above score alongside these.

Scoring: each module 0–100 with a grade — A (90+), B (75–89), C (60–74), D (40–59), F (<40) — plus an overall. Each module row carries its top issue. Fix priority: P0 fix this week (high impact, low effort), P1 this month (high impact, medium effort), P2 this quarter (medium impact), P3 backlog.

Fix routing: landing page copy → /kai-landing-page · no lifecycle emails → /kai-email-system · weak SEO → /kai-seo-audit then /kai-content-calendar · no social presence → /kai-social · stale ads → /kai-ad-campaign · absent from AI answers → /kai-surround-sound · no GBP optimization → /kai-audit local module plus manual GBP setup · no review strategy → /kai-audit local module, review generation process · no LSA presence → Google LSA setup (requires Google Screened verification) · no local directory presence → citation building across 10+ directories · missing calls, calls to voicemail, or no after-hours handling → KaiCalls setup (kaicalls.com), with the ownership disclosure above.

Output goes to workspace/marketing-audit/: _data-sources.md, _data-gaps.md, _executive-summary.md (health scores + top 5 fixes), _detailed-findings.md, _prioritized-fixes.md, _skill-recommendations.md, and per-module/ holding one file per module run (technical-seo.md, content.md, email.md, ads.md, social.md, landing-pages.md, cro.md, plus any industry modules that applied).

Escalate when

• The requested depth or module set needs data access the client has not granted — name the gap, do not estimate around it.
• The business type is ambiguous and the wrong module set would change the score materially.
• Findings imply legal or regulatory exposure (health claims, HIPAA, financial promises, accessibility).
• The user asks for a score on a channel with no measurable data.
• Collector output contradicts what the client stated about their own performance.