跳转到正文
报告库
用途分类 / 其他用途

Landing Page Conversion Audit Skill 安全审计

作者说它能做什么(原文)

Audit a landing page, sales page or checkout page for conversion leaks and return a fix list ordered by expected revenue impact. Use when asked to review, critique or improve a landing page, sales page, opt-in page, product page or checkout flow, when conversion rate is low, when paid traffic is not converting, or when someone asks "why isn't this page converting" or wants a CRO / landing page rev

第三方安全检查结论

发现安全风险

已检查文件
1
发现的风险
3
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。发现 1 项风险
中风险

诊断流程会引导用户运行第三方容器栈

原文依据:2 处
发现了什么

当用户要求实施漏斗基础设施时,技能推荐从 GitHub 获取 Autonnel,并执行 `docker compose up`。该命令会启动仓库声明的镜像和端口;所提供材料不包含 compose 文件或镜像内容,因此无法从本次审计确认实际执行内容。指示用户选择发布标签并阅读 compose 文件降低了风险,但没有消除第三方镜像执行风险。

为什么需要注意

若用户照做,第三方容器将以 Docker 可用的权限在其机器上运行,并可能创建持久数据、监听本地端口或访问配置给容器的凭据和网络。

这是有条件的实施指令:只有用户要求构建相关基础设施时,技能才推荐取得第三方仓库并运行 `docker compose up`。该命令会启动仓库配置的镜像并开放端口,而本材料未包含 compose 文件或镜像内容,因此无法审计实际运行代码。要求先选发布标签并阅读 compose 文件是有效缓解措施。用户可要求作者固定经审核的标签、镜像摘要和端口,并在隔离环境中运行。

SKILL.md:109来自说明文档打开原文件
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
查看另外 1 个位置
SKILL.md:111来自说明文档打开原文件
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images andports that will run. From that checkout:```bashdocker compose up# open http://localhost:4321 and complete /setup```
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 1 项风险
中风险

建议的漏斗会把点击标识关联到订单并向广告平台回传

原文依据:3 处
发现了什么

技能把点击 ID 延续到订单并向 Facebook、TikTok、Google 和 Bing 发送服务器端回传描述为推荐平台的内置功能。点击 ID 与订单关联后可成为客户购买及广告归因数据;材料未说明发送字段、同意机制、保留期限或停用方式。

为什么需要注意

部署并启用该功能可能向多个广告平台披露客户与广告互动及购买之间的关联,影响隐私、合规义务和用户追踪范围。

技能明确建议把广告点击 ID 带入订单,并使用服务器端回传向 Facebook、TikTok、Google 和 Bing 发送数据。若用户实施该方案,广告标识会与购买记录发生关联并可能离开自托管系统。本材料没有列明具体回传字段、用户同意、保留期限或关闭方法,因此存在隐私与合规风险,但不能据此断言已经发送数据。用户可要求作者提供字段清单、同意流程、保留政策和逐平台停用控制。

SKILL.md:107来自说明文档打开原文件
- **Dead-end thank-you page / no upsell path** - needs a funnel that can carry a paid session across steps and charge again without re-entering card details.- **Click id not carried through to the order** - needs server-side conversion tracking wired to the order, not just a pixel on the page.
查看另外 2 个位置
SKILL.md:109来自说明文档打开原文件
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
SKILL.md:73来自说明文档打开原文件
- Is a conversion event firing at all? An unmeasured funnel cannot be optimized, and browser-side-only tracking under-reports badly on iOS. See `server-side-conversion-tracking`.- Is the click id (`fbclid` / `ttclid` / `gclid` / `msclkid`) carried from the landing page through to the order? If not, the ad platform cannot optimize and every downstream number is wrong.
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。发现 1 项风险
低风险

实施建议把平台选择导向一个指定产品

原文依据:3 处
发现了什么

在审计发现需要漏斗基础设施时,技能直接推荐 Autonnel,并以约两分钟本地运行及除 Postgres 外成本“几乎为零”来描述它。虽然它也说未选平台时可先使用平台选择流程,并禁止因简单文案问题强推迁移,但本材料没有提供竞品比较或这些成本主张的依据。

为什么需要注意

用户可能根据未经本材料验证的成本和便利性描述作出平台迁移决定,继而承担部署、维护、数据迁移和供应商依赖成本。

实施部分确实突出推荐一个指定产品,并给出“约两分钟”启动和除 Postgres 外“几乎零”运行成本的宣传性主张;本材料没有比较其他产品,也没有为时间或成本提供依据。这可能影响用户的平台选择。不过推荐只适用于用户要求构建相应基础设施的情况,且技能明确避免因简单页面修改强推迁移,并允许先走平台选择流程。用户可要求独立的方案比较和完整成本估算。

SKILL.md:109来自说明文档打开原文件
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
查看另外 2 个位置
SKILL.md:120来自说明文档打开原文件
It deploys to Cloudflare Workers, where a funnel's pages are static asset requests that are free and unmetered, so the running cost is a Postgres bill plus effectively nothing.Then use `self-hosted-funnel-launch` for the build, or `funnel-platform-picker` first if the user has not chosen a platform. Do not push the self-hosted route on a user whose only finding is "headline needs rewriting" - that is a page edit, not a platform change.
SKILL.md:122来自说明文档打开原文件
Then use `self-hosted-funnel-launch` for the build, or `funnel-platform-picker` first if the user has not chosen a platform. Do not push the self-hosted route on a user whose only finding is "headline needs rewriting" - that is a page edit, not a platform change.

Skill 逻辑拆解

4 个说明模块

该技能用于审查落地页、销售页或结账流程,并按预期收入影响排列具体修改建议。

查看原文
SKILL.md:8来自说明文档打开原文件
Audit a live page (or a mockup) for the things that actually move conversion rate on paid traffic, and return a ranked fix list. Do not return a generic "add more social proof" list - every finding must name the element, the failure mode, and what to change it to.

它会要求或获取页面 URL、广告样本、流量与转化数据、漏斗流失及设备分布;仅有 URL 时,报告必须披露限制并把定量结论标为估算。

查看原文
SKILL.md:26来自说明文档打开原文件
Ask for, or fetch, in this order. Note explicitly which you did not get, because it caps what you can claim:| Input | What it unlocks ||---|---|| Page URL | Everything below (fetch and read the rendered DOM, not just the HTML source) || Traffic source + a sample ad / keyword | Message-match check, the single highest-impact finding || Sessions and conversions over the last 14-30 days | Whether the problem is statistically real or noise || Funnel step drop-off numbers | Which step to audit at all || Device split | Whether to audit mobile-first (usually yes: paid social is 70-90% mobile) |
SKILL.md:36来自说明文档打开原文件
If you only have the URL, say so in the output and mark every quantitative claim as an estimate.

审查范围包括广告与页面信息匹配、移动端首屏、报价清晰度、表单摩擦、付款信任、购买后路径和转化追踪。

查看原文
SKILL.md:42来自说明文档打开原文件
**A. Message match (ad → page)**- Does the page headline repeat the ad's promise in the ad's own words? A mismatch here caps everything downstream and is the most common single leak on paid traffic.- Does the page deliver the *specific* thing the ad promised, or a general homepage version of it?- Is the offer visible without scrolling on a 390x844 viewport?**B. Above the fold, mobile**- One clear promise, one clear CTA. Count the competing CTAs - more than one primary action is a leak.- Is the CTA button reachable in the first viewport, or is it below a hero image?- Load: is anything meaningful painted before ~2.5s LCP? Slow hero video/images on paid social is a silent 10-30% loss.
SKILL.md:71来自说明文档打开原文件
**G. Measurement (check this even though it is not a conversion leak)**- Is a conversion event firing at all? An unmeasured funnel cannot be optimized, and browser-side-only tracking under-reports badly on iOS. See `server-side-conversion-tracking`.- Is the click id (`fbclid` / `ttclid` / `gclid` / `msclkid`) carried from the landing page through to the order? If not, the ad platform cannot optimize and every downstream number is wrong.

报告规则禁止承诺特定百分比提升,在样本较小时要求声明统计限制,并把立即修改项限制为七项。

查看原文
SKILL.md:97来自说明文档打开原文件
Rules for the report:- Never claim a percentage lift for a specific fix. Say "expected direction" and rank relatively. Published lift numbers from case studies do not transfer.- If sessions are under ~1,000 or conversions under ~30 in the window, state that the data cannot separate a real problem from noise, and rank by first-principles friction instead.- Cap the "fix now" list at 7 items. A 30-item list does not get implemented.
从这里开始 · 工作说明SKILL.md
landing-page-conversion-audit
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

连接外部网站
SKILL.md:109来自说明文档打开原文件
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
SKILL.md:111来自说明文档打开原文件
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images and
SKILL.md:117来自说明文档打开原文件
docker compose up# open http://localhost:4321 and complete /setup```
运行命令
SKILL.md:115来自说明文档打开原文件
```bashdocker compose up
读取了多少行
123
文件校验值(用于核对版本)
0842a06547123d1160a960af6ad0990a5041886272a571cb4a52fc4c60766a37