Kai root note: knowledge/, harness/, and scripts/ paths in this skill live in the Kai install, not the user's project. Resolve them against the first ancestor directory of this SKILL.md that contains a knowledge/ folder (the Kai plugin root, ~/.claude/kai, or the kai-cmo-harness repo). MARKETING.md, memory/, and any output files live in the current project. If a referenced scripts/ command is not available in this install, say so, skip it, and continue with the file-based guidance — never fabricate its output.

/kai-audit — A Sourced Read On What Is Actually Broken

Objective

A full marketing health report for one business: every applicable harness checklist run against the real site and the real channels, a health score per module that only counts measured findings, and one prioritized fix list that routes each fix to the skill or action that resolves it. Every number in it traces to a collector source someone else can re-pull.

An audit's value is entirely in the sourcing. A score built on estimates is worse than no score, because it gets quoted.

A third-party local business audited from a Maps, share.google or website link — located rankings, map packs, AI answers, offers and a 12-week plan — is /kai-local-audit.

Done when

Work type audit-report — floor E3/C4/O1 (harness/eco-floors.yaml), client_facing: true.

• E3 — the delivered file is the approved, hash-pinned version, and every quantitative claim resolves to a collector source in workspace/marketing-audit/.
• C4 — the Kai Data Provenance Rule, in full: the collector ran before writing, the mode is declared, every number cites a source, missing data sits in _data-gaps.md, and python scripts/quality_gates/audit_provenance_lint.py workspace/marketing-audit --audit-dir passes. Plus banned_word_check. C4 is not a lint pass — it is the field standard for client-facing analysis.
• O1 — every P0 fix names the metric it targets, its baseline, and an owner. The audit's own outcome, read at 60 days, is whether its recommendations were accepted and implemented.

Constraints

Provenance — non-negotiable

Load harness/references/audit-data-provenance.md before writing any finding. Declare exactly one mode:

Mode	Use when	Client-facing label
sales_external	Prospect or sales process, before private access is granted	Sales intelligence audit - external-only
onboarding_connected	Client signed and granted GSC, GA4, GBP, ads, CRM, or call data access	Client onboarding audit
internal_demo	Showing the shape of the workflow before data is connected	Internal demo - sample data

Default to sales_external when access is unclear.

1. No number without a source. Review counts, ratings, rankings, traffic, conversions, calls, Core Web Vitals, Domain Rating, referring domains, AI Overview visibility, and local pack placement each need a source, a retrieval date, and an artifact or API note.
2. Do not score what was not measured. Missing GSC, GA4, GBP, call tracking, backlink, or ad-platform data is a data gap, never an invented estimate.
3. Do not turn inference into fact. Hypotheses are labeled score_eligible: false and stay out of client-facing health scores.
4. Do not cite a tool that did not run. If the report names Ahrefs, DataForSEO, PageSpeed Insights, BuiltWith, Google Places, GSC, GA4, GBP, CallRail, or a CRM, it includes the retrieval date and the raw artifact path or response summary.
5. Every deck slide with a number needs a source footer. Every audit folder needs _data-sources.md and _data-gaps.md.

Collector before writing

python -m scripts.audit.collect --url "<url>" --firm-name "<firm_name>" --mode sales_external --workflow audit --out workspace/marketing-audit --pagespeed

Use --mode onboarding_connected only when the client granted private access, and add optional collectors only for facts the audit actually needs: --places --dataforseo --seo-provider auto --gsc --ga4 --calls --keywords "<kw1>,<kw2>" --location "<city, state>" --date-from "<YYYY-MM-DD>" --date-to "<YYYY-MM-DD>". Add --third-party-sources all or a comma list (serpapi,similarweb,builtwith,wappalyzer,brightlocal,yext,yelp,trustpilot,google-ads,meta-ads,tiktok-ads,linkedin-ads,twilio) when licensed vendor data is needed — API vendor values are third_party_estimate, supplied exports are user_provided.

The collector writes kai-data.json, audit-data.json, _data-sources.md, _data-gaps.md, and raw/ under workspace/marketing-audit/. All findings, health scores, and deck numbers come from audit-data.json. Not from conversation, not from snippets, not from model memory. A metric absent from audit-data.json becomes a data gap. Missing credentials stay data gaps until the collector records a sourced metric.

The collector is shared across Kai workflows; this audit consumes the audit-data.json alias. Existing audit automations may keep using python -m scripts.audit.collect; non-audit workflows prefer python -m kai.source_data.collect and read kai-data.json.

If the collector scripts are not in this install (skills-only or plugin install, no scripts/audit/), run in qualitative mode: browse the target's public pages directly, cite URL and retrieval date for every observation, put every unmeasurable quantitative claim in _data-gaps.md, and state plainly in the report header that collector-backed metrics require the full harness (github.com/cgallic/kai-cmo-harness). Never estimate a number the collector would have measured.

Everything else

• Read MARKETING.md from the project root first. If it does not exist, build it from the codebase — CLAUDE.md, README.md, PROJECT.md, package.json, landing pages, email/ad/analytics config — using the template from /kai-email-system, and confirm the draft. Do not ask the user what the product is.
• Eight things must be known before scoping: what is being audited; the main URL; which channels are active; known issues already flagged; depth (quick top-line scores, ~30 min, or deep detailed findings, 2–3 hours); the audit mode; which data access exists; and the business type.
• Every check gets a provenance record: claim, source_tier (connected | public_observed | user_provided | inferred | missing_data), source_name, source_url, retrieved_at, confidence (high/medium/low), evidence_artifact, score_eligible. Only connected, public_observed, and user_provided findings affect health scores. inferred and missing_data are scope notes unless the user explicitly asks for internal hypotheses.
• Phone lead capture is evaluated for every business, via the Phone-Based Lead Capture section of cro-audit-checklist.md. Apply the Phone Capture Fit Rule: compare options (staffed reception, answering services, AI receptionists, callback widgets), and recommend a phone answering service or AI receptionist only when missed-call, after-hours, speed-to-lead, qualification, routing, or call-logging evidence supports it.
• Skip checklists for channels the business does not use. An empty module scored zero is a fabricated finding.

Context

Need	Load
Provenance rule, modes, source tiers	harness/references/audit-data-provenance.md
Product, ICP, channels, competitors	MARKETING.md (project root)
All module checklists	knowledge/checklists/

Business type drives which industry module loads. A business can match several — a multi-location dental practice triggers both Multi-Location and Healthcare. Load all that apply.

Type	Indicators	Module (knowledge/checklists/)
Local Service	Geographic service area, phone-based leads	local-service-business-checklist.md
Professional Services (B2B)	Credential-based, trust-heavy, long cycle	professional-services-b2b-checklist.md
Multi-Location	2+ locations, franchise, chain	multi-location-checklist.md
Restaurant / Food & Bev	Food or drink is the product	restaurant-food-bev-checklist.md
Healthcare / Medical	Patient-facing, HIPAA-regulated	healthcare-medical-checklist.md
Creator / Personal Brand	The individual is the brand	creator-personal-brand-checklist.md
Real Estate	Agent, team, brokerage, property manager	real-estate-checklist.md
SaaS / Digital Product	Software, online-first, subscription	No additional module — existing modules cover it

Audit modules:

Module	Checklist files	Applies when
Technical SEO	technical-seo-audit-sop.md, technical-seo-checklist.md	Always, if there is a website
On-Page SEO	seo-checklist.md	Always
Content Quality	content-checklist.md, content-brief-checklist.md	If publishing content
Email	email-checklist.md	If running email
Meta/Facebook Ads	meta-advertising-checklist.md	If running Meta ads
Google Ads	google-ads-launch-checklist.md, paid-acquisition-checklist.md	If running Google ads
LinkedIn Ads	linkedin-ads-launch-checklist.md	If running LinkedIn ads
TikTok	tiktok-checklist.md	If on TikTok
Social Media	social-media-audit-checklist.md	If active on social
Landing Pages	landing-page-messaging-checklist.md	If they have landing pages
CRO	cro-audit-checklist.md	Always, for the main conversion flow
Phone capture	cro-audit-checklist.md (Phone-Based Lead Capture)	Always
Perception/Copy	perception-engineering-checklist.md	For sales-focused pages
Ad Creative	creative-production-checklist.md, ad-launch-checklist.md	If running any ads
PR	pr-checklist.md	If doing press/PR
Website Launch	website-launch-checklist.md	If the site is new
2026 Readiness	2026-readiness-checklist.md	Always

Industry modules from the business-type table above score alongside these.

Scoring: each module 0–100 with a grade — A (90+), B (75–89), C (60–74), D (40–59), F (<40) — plus an overall. Each module row carries its top issue. Fix priority: P0 fix this week (high impact, low effort), P1 this month (high impact, medium effort), P2 this quarter (medium impact), P3 backlog.

Fix routing: landing page copy → /kai-landing-page · no lifecycle emails → /kai-email-system · weak SEO → /kai-seo-audit then /kai-content-calendar · no social presence → /kai-social · stale ads → /kai-ad-campaign · absent from AI answers → /kai-surround-sound · no GBP optimization → /kai-audit local module plus manual GBP setup · no review strategy → /kai-audit local module, review generation process · no LSA presence → Google LSA setup (requires Google Screened verification) · no local directory presence → citation building across 10+ directories · missing calls, calls to voicemail, or no after-hours handling → phone answering service or AI receptionist setup, under the Phone Capture Fit Rule above.

Output goes to workspace/marketing-audit/: _data-sources.md, _data-gaps.md, _executive-summary.md (health scores + top 5 fixes), _detailed-findings.md, _prioritized-fixes.md, _skill-recommendations.md, and per-module/ holding one file per module run (technical-seo.md, content.md, email.md, ads.md, social.md, landing-pages.md, cro.md, plus any industry modules that applied).

Escalate when

• The requested depth or module set needs data access the client has not granted — name the gap, do not estimate around it.
• The business type is ambiguous and the wrong module set would change the score materially.
• Findings imply legal or regulatory exposure (health claims, HIPAA, financial promises, accessibility).
• The user asks for a score on a channel with no measurable data.
• Collector output contradicts what the client stated about their own performance.