Enforce quality control, evidence verification, and quality gates during security audits and code reviews.
- GitHub stars
- 41,038
- Files
- 8
- Last commit
- Nov 11, 2026
- License
- MIT
- Allowed tools
- —
What does the audit-integrity skill do?
audit-integrity is an agent skill. Enforce quality control, evidence verification, and quality gates during security audits and code reviews.
Summary generated from the skill's SKILL.md.
About the audit-integrity skill
Security professionals and developers use this skill to maintain high standards during SAST, SCA, threat modeling, and security code reviews. It functions as a quality control layer that ensures every security finding is backed by verified code locations and taint traces. By loading specific modular components from the references directory, an agent can enforce strict rules against the suppression of valid vulnerabilities and prevent the fabrication of evidence.
The skill operates through a structured execution flow that begins with a clarification protocol for defining scope and ends with a self-reflection quality gate. Before any report is delivered, the agent must use a scoring rubric to ensure the draft meets a minimum threshold of 8 out of 10. It also includes a retry protocol for handling tool failures and a self-learning system to document lessons learned and security memories after a scan is complete.
What an agent can do with it
- 1Verify security finding evidenceEnsure that every identified vulnerability includes verified code locations and taint flow traces.
- 2Prevent finding suppressionStop the agent from rationalizing away or ignoring valid security issues during a review.
- 3Enforce report quality thresholdsCheck that a draft security report meets a minimum quality score before it is sent to a user.
- 4Handle tool execution failuresManage instances where a search or tool fails by retrying once and then documenting the result.
Written from the skill's SKILL.md. Every use case is checked against a quote from it.
How to install the audit-integrity skill
Each command copies the skill folder into the client's skills directory. Restart the client or start a new session to load it.Install the audit-integrity skill in Claude Code
~/.claude/skills/audit-integrity/SKILL.md
$ npx degit github/awesome-copilot/skills/audit-integrity ~/.claude/skills/audit-integrityInstall the audit-integrity skill in Claude Code (project)
.claude/skills/audit-integrity/SKILL.md
$ npx degit github/awesome-copilot/skills/audit-integrity .claude/skills/audit-integrityInstall the audit-integrity skill in Codex
~/.agents/skills/audit-integrity/SKILL.md
$ npx degit github/awesome-copilot/skills/audit-integrity ~/.agents/skills/audit-integrityInstall the audit-integrity skill in Gemini CLI
~/.gemini/skills/audit-integrity/SKILL.md
$ npx degit github/awesome-copilot/skills/audit-integrity ~/.gemini/skills/audit-integrityInstall the audit-integrity skill in Claude.ai
npx degit github/awesome-copilot/skills/audit-integrity audit-integrity && zip -r audit-integrity.zip audit-integrity # claude.ai → Customize → Skills → + → Create skill → Upload a skill → audit-integrity.zip
Automated checks
Ran Nov 13, 2026Full report →Passed our automated checks. That is not a security audit: read the scripts before you let an agent run them. How checks work
- Source repository linked and reachablegithub/awesome-copilot/skills/audit-integrity is public and reachablegithub.com/github/awesome-copilot/tree/HEAD/skills/audit-int ↗Pass
- Open source license (OSI)MITspdx.org/licenses/MIT.html ↗Pass
- Commit or release in the last yearLast commit 2026-11-11github.com/github/awesome-copilot/commits ↗Pass
- No download-and-run or credential theft in scriptsNo scripts in the skill folderPass
- No hidden instructions in SKILL.mdNo override phrases, safeguard switches, credential requests or hidden charactersgithub.com/github/awesome-copilot/blob/HEAD/skills/audit-int ↗Pass
- Pre-approved tools are scopedNo pre-approved tools; the agent asks before using onegithub.com/github/awesome-copilot/blob/HEAD/skills/audit-int ↗Pass
SKILL.md
View on GitHubAudit Integrity Skill
Enforce output quality, intellectual honesty, and continuous improvement across security audits and code reviews.
When to Use
- Perform security analyses, threat models, code reviews, or quality audits.
- Validate that every finding has verified code evidence and taint flow.
- Prevent the suppression or rationalization of security findings.
- Evaluate draft reports against the quality gate threshold (score ≥ 8/10).
- Record lessons learned and security memories after you complete a scan.
Components
This skill provides 7 modular capabilities in the references/ directory. Load each file when you reach its execution phase:
| Component | Reference File | Purpose |
|---|---|---|
| Clarification Protocol | references/clarification-protocol.md | Ask a maximum of 2 targeted questions when scope is not clear |
| Anti-Rationalization Guard | references/anti-rationalization-guard.md | Prohibited rationalizations and mandatory responses for findings |
| Self-Critique Loop | references/self-critique-loop.md | Mandatory second pass to verify evidence and coverage |
| Retry Protocol | references/retry-protocol.md | Tool failure and empty search handling: retry once, then document |
| Non-Negotiable Behaviors | references/non-negotiable-behaviors.md | Mandatory rules: do not fabricate, cite evidence, report gaps |
| Self-Reflection Quality Gate | references/self-reflection-quality-gate.md | Scoring rubric (1–10 scale) with a minimum threshold of 8 |
| Self-Learning System | references/self-learning-system.md | Templates and rules for lessons and security memories |
Execution Flow
Load reference files as you reach each phase:
- Before analysis: If scope or policy is not clear, read references/clarification-protocol.md. Ask a maximum of 2 targeted questions.
- During analysis: Follow references/non-negotiable-behaviors.md. At each triage decision, consult references/anti-rationalization-guard.md.
- On tool or search failure: Follow references/retry-protocol.md. Do not assume code is secure without verification.
- After initial analysis: Complete a second pass with the checklist in references/self-critique-loop.md. Verify taint traces and manifest coverage.
- Before delivery: Score the draft report using references/self-reflection-quality-gate.md. All categories must score ≥ 8.
- Final delivery: Record lessons and memories using references/self-learning-system.md.
Files in this skill
8audit-integrity skill questions
How do I install the audit-integrity skill in Claude Code?
Run npx degit github/awesome-copilot/skills/audit-integrity ~/.claude/skills/audit-integrity. Claude Code loads skills from ~/.claude/skills (all projects) or .claude/skills (one project) and uses a skill when its description matches the task.
Which clients can use the audit-integrity skill?
Any client that reads the Agent Skills format: Claude Code, Codex, Gemini CLI and claude.ai (upload as a ZIP). Scripts in the skill run only where the client allows code execution.
What is the minimum quality score required for a report before delivery?
Reports must meet a minimum quality threshold score of 8 out of 10.
How many questions can be asked if the audit scope is unclear?
The agent is permitted to ask a maximum of two targeted questions to clarify the scope.
What should be done if a tool or search fails during analysis?
The agent should follow the retry protocol, which involves retrying once and then documenting the failure.