Internal affairs
FAT Agent is a security tester as much as an SEO auditor. He looks at your site the way an attacker would, from the outside: headers, leaked keys, exposed files, cookies, certificates, DNS, email spoofing and consent. Then he tells you exactly what to change.
What he checks
Presence is not enough. A Content-Security-Policy full of 'unsafe-inline' is a lock with the key in it, so he grades the quality of each defence, not just whether it exists.
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy, Permissions-Policy and X-Content-Type-Options.
P1Missing Content-Security-Policy header
He reads your page source and inline scripts for credentials that should never ship to a browser.
P0Secret exposed in page source
An opt-in probe for files that leak from misconfigured servers. It is same-origin only, makes one request per path, and runs only with your go-ahead.
FAT Agent.env.env.local.env.production.git/config.git/HEAD.svn/entries.hg/requireswp-config.php.bakconfig.php.bak.aws/credentials.npmrc.dockerenvdocker-compose.ymlbackup.zipbackup.sqldb.sqldump.sqlphpinfo.phpinfo.phpserver-status.DS_Store.vscode/settings.jsonconfig.jsonsecurity.txtP0Exposed sensitive path: /.env
Every Set-Cookie header is checked for the three flags that stop theft and cross-site abuse.
P2Cookies set without HttpOnly
Third-party scripts are the most common way into a modern site. He checks what you load and what you leak about your stack.
P2Cross-origin scripts without Subresource Integrity
The certificate and DNS records that everything else trusts.
P0SSL certificate invalid or missing
If your domain can be spoofed, your customers can be phished in your name.
P1Missing DMARC record
Trackers that fire before consent are a legal risk as well as a trust one.
P1Tracking may load before consent
With Search Console connected he reads Google's own verdicts, and the page checks catch the tricks hacked sites get used for.
P0Security issue reported by Google
Rules of engagement
Everything runs from the outside, the way a visitor or attacker sees your site, and nothing he does changes it.
Headers, page source, certificates and DNS come from normal requests. No logins, no form submissions, no load testing.
The exposed-files check only runs when you confirm it, for sites you own or are authorised to test. It never fuzzes: a fixed list, one request each.
Requests to private networks, localhost and cloud metadata addresses are blocked, so the crawler can't be turned against your own infrastructure.
On Shopify or Wix you can't set security headers. He says so, scores it as a platform limit and tells you what you can do instead.
Priorities
| Priority | Means | Security examples |
|---|---|---|
| P0 | Drop everything | Live secret key in page source, exposed .env or .git, invalid certificate, Google-reported security issue |
| P1 | This week | No CSP or HSTS, no DMARC, tracking before consent, sneaky redirects |
| P2 | This month | Weak CSP, cookies without HttpOnly or SameSite, scripts without SRI, source maps in production |
| P3 | Polish | Server version disclosed, no security.txt, missing CAA record |
Install
Inside Claude Code, run these two lines. Then point him at a site.
/plugin marketplace add spruikco/fat-agent-skill/plugin install fat-agent@fat-agent-marketplaceRun /fat-audit https://your-site.com, or just say "run FAT agent on my site".