Agent Readiness Audit

Agent Readiness Audit Skill

A growing share of your product's users aren't human: agents research it, evaluate it, onboard onto it, and operate it on their principals' behalf. They can't watch your demo video, guess what an unlabeled icon means, or call support. This skill audits every surface an agent touches and scores how much of your product is invisible or unusable to them.

What This Skill Produces

• A readiness score by surface (discovery, docs, API/auth, errors, onboarding, transactions)
• Per-surface findings with the failing artifact quoted and the fix
• A prioritised fix list ranked by agent-traffic impact vs effort
• A re-test protocol so readiness is measured, not vibed

Required Inputs

Ask for (if not already provided):

• The product and its public surfaces (site, docs URL, API reference, status page)
• What agents will be asked to do with it — research/compare? sign up? operate it daily?
• What exists already: llms.txt? MCP server? OpenAPI spec? If unknown, the audit checks
• Any observed agent failures (the best audit seed there is)

The Audit Surfaces

Walk each surface asking one question: could a capable agent, starting cold, complete its job here without a human unblocking it?

1. Discovery — can agents find and understand what you are? llms.txt present and current · docs fetchable as clean markdown/text (not JS-rendered walls) · pricing and limits stated in prose an agent can quote · comparison-relevant facts (SOC 2, SSO, data residency) written down anywhere at all — an agent can't infer what you never wrote.

2. Docs — written for readers who execute? Every task documented as copy-runnable steps with expected outputs · code samples that actually run (agents execute them verbatim) · one canonical way per task (agents can't arbitrate between three contradictory tutorials) · error-message strings from the product appearing verbatim in the docs so search-by-error works.

3. API & auth — self-serve without a human? Key/token obtainable without a sales call (or the agent path is documented honestly) · OpenAPI spec accurate to the deployed API · rate limits discoverable programmatically · an MCP server, or at least a stated position on one.

4. Errors — instructive to a retrying machine? Errors name the field and the fix · machine-readable codes stable across releases · 4xx vs 5xx used honestly (agents branch on this) · no CAPTCHAs on API-adjacent flows without a documented alternative.

5. Onboarding & transactions — can an agent complete them? Signup/checkout completable without image CAPTCHAs, drag-widgets, or SMS-only verification (or agent-appropriate alternatives exist) · forms with real labels, not placeholder-only · the confirmation state readable as text.

6. Guardrails — do you know your agent traffic? Are agents distinguishable in analytics? Is there a stated policy (terms + technical) for agent use — welcome, gated, or forbidden? Silence is a decision made by accident.

Score each surface 0-4: 0 = actively hostile · 2 = humans-only assumptions throughout · 4 = agent-native. Cite the failing artifact for anything below 3.