Audit Integrity — Agent Skill by GitHub

From the author

Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.

— the description by vijay-kr-bandi

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Audit Integrity provides a comprehensive methodology for conducting security assessments, including SAST, SCA, and threat modeling. It mandates a disciplined approach to analysis, requiring verified evidence for all findings and preventing the silent suppression of potential risks. By utilizing a series of modular protocols, the skill ensures that audits are thorough, intellectually honest, and meet a minimum quality threshold of 8/10 before final delivery.

What it does

Enforces a mandatory second-pass critique to verify evidence and taint traces.
Provides an anti-rationalization guard to prevent the dismissal of valid security findings.
Implements a quality gate rubric to score reports against a minimum threshold.
Standardizes the handling of tool failures and ambiguous project scopes.
Facilitates continuous improvement through a structured post-audit reflection system.
Ensures all security findings are backed by explicit code evidence or architectural references.

When to use it

When performing security code reviews or static analysis (SAST).
During threat modeling exercises to ensure comprehensive coverage.
When you need to validate the integrity of a security report before final delivery.
When you want to ensure that no security findings are suppressed without documented justification.
When you need to improve the consistency and quality of your security audit outputs.

Advantages

Reduces the risk of false negatives by prohibiting silent suppression of findings.
Increases report credibility through mandatory evidence-based justifications.
Ensures consistent audit quality via a standardized scoring rubric.
Provides clear protocols for handling common pitfalls like tool errors or scope ambiguity.
Promotes long-term learning by capturing security memories and lessons learned.

Usage examples

“Perform a security audit on this repository and apply the Audit Integrity skill.”: The agent will initiate the audit, starting with the clarification protocol if needed, and follow the mandatory execution flow to ensure all findings are verified and the final report meets the 8/10 quality gate.
“I think this finding is a false positive, can we ignore it?”: The agent will consult the anti-rationalization guard, requiring you to document the rationale for the false positive while ensuring the finding is still included in the report rather than silently suppressed.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/github/audit-integrity/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip audit-integrity.zip -d .agents/skills

Documentation by vijay-kr-bandi

Audit Integrity Skill

Enforce output quality, intellectual honesty, and continuous improvement across security audits and code reviews.

When to Use

Perform security analyses, threat models, code reviews, or quality audits.
Validate that every finding has verified code evidence and taint flow.
Prevent the suppression or rationalization of security findings.
Evaluate draft reports against the quality gate threshold (score ≥ 8/10).
Record lessons learned and security memories after you complete a scan.

Components

This skill provides 7 modular capabilities in the references/ directory. Load each file when you reach its execution phase:

Component	Reference File	Purpose
Clarification Protocol	references/clarification-protocol.md	Ask a maximum of 2 targeted questions when scope is not clear
Anti-Rationalization Guard	references/anti-rationalization-guard.md	Prohibited rationalizations and mandatory responses for findings
Self-Critique Loop	references/self-critique-loop.md	Mandatory second pass to verify evidence and coverage
Retry Protocol	references/retry-protocol.md	Tool failure and empty search handling: retry once, then document
Non-Negotiable Behaviors	references/non-negotiable-behaviors.md	Mandatory rules: do not fabricate, cite evidence, report gaps
Self-Reflection Quality Gate	references/self-reflection-quality-gate.md	Scoring rubric (1–10 scale) with a minimum threshold of 8
Self-Learning System	references/self-learning-system.md	Templates and rules for lessons and security memories

Execution Flow

Load reference files as you reach each phase:

Before analysis: If scope or policy is not clear, read references/clarification-protocol.md. Ask a maximum of 2 targeted questions.
During analysis: Follow references/non-negotiable-behaviors.md. At each triage decision, consult references/anti-rationalization-guard.md.
On tool or search failure: Follow references/retry-protocol.md. Do not assume code is secure without verification.
After initial analysis: Complete a second pass with the checklist in references/self-critique-loop.md. Verify taint traces and manifest coverage.
Before delivery: Score the draft report using references/self-reflection-quality-gate.md. All categories must score ≥ 8.
Final delivery: Record lessons and memories using references/self-learning-system.md.

Files

ATTRIBUTION.mdAdded by AutoGineer832 B
LICENSELicence file added by AutoGineer1.0 KiB
SKILL.md3.9 KiB
references/anti-rationalization-guard.md3.2 KiB
references/clarification-protocol.md807 B
references/non-negotiable-behaviors.md1.2 KiB
references/retry-protocol.md536 B
references/self-critique-loop.md1.6 KiB
references/self-learning-system.md2.2 KiB
references/self-reflection-quality-gate.md4.6 KiB

references/self-reflection-quality-gate.md

Self-Reflection Quality Gate

After you complete the analysis, score the output across domain categories on a 1–10 scale.

Threshold: Every category must score ≥ 8 to pass. If any category scores < 8, resolve the gaps before you deliver the report (maximum 2 rework iterations).

Core Scoring Rubric (Universal)

Category	Score 9–10	Score 7–8	Score 5–6	Score 1–4
Completeness	All phases, categories, boundaries, and checklists evaluated with explicit evidence	Minor omissions that do not affect the risk profile	Noticeable gaps in coverage; entire sections omitted	Superficial pass; major sections missing
Accuracy	Precise file:line references, confirmed CVE IDs, verified taint flows, correct CWE mappings	Minor version ambiguity or indirect references; core findings correct	Plausible findings with unverified details or questionable mappings	Fabricated references, wrong CWE mappings, or hallucinated CVEs
Actionability	Concrete remediation code, exact package upgrade targets, step-by-step guidance	Clear direction but requires human adjustment	High-level advice without code or version targets	Generic platitudes ("sanitize inputs", "keep packages updated")
Consistency	Risk ratings match evidence, framework verdicts align with findings, formatting uniform	Minor formatting or taxonomy inconsistencies	Severity ratings conflict with impact descriptions	Contradictory findings or incompatible verdicts
Evidence Rigor	Every claim backed by code, manifest, trace, or threat model element	Most findings backed; some secondary claims lack citations	Assertions made without code citations	Speculative findings with zero code or manifest backing

Scoring Threshold

Final Score	Action
All categories ≥ 8	PASS — Proceed to final delivery
Any category < 8 (attempt 1)	REWORK — Address deficiencies and re-score
Any category < 8 (attempt 2)	REWORK — Final attempt to resolve gaps
Any category < 8 (attempt 3)	FLAG & DELIVER — Deliver with explicit quality gap disclosure to user

Domain-Specific Rubrics

SAST/SCA

Category	Question	Threshold
Completeness	Did you evaluate all SAST flaw categories and SCA ecosystems?	≥ 8
Accuracy	Are findings supported by concrete taint traces and verified CVE IDs?	≥ 8
Actionability	Does each Critical and High finding have a concrete code fix or upgrade step?	≥ 8
Consistency	Are severity ratings, CWE mappings, and policy verdicts consistent across the report?	≥ 8
Coverage	Did you trace all entry points from source to sink and audit all dependency manifests?	≥ 8

Threat Modeling and Code Review

Category	Question	Threshold
Completeness	Did you evaluate all six STRIDE categories for each trust boundary and data flow?	≥ 8
Coverage	Were all entry points, trust boundaries, and data flows traced from source to sink?	≥ 8

Requirements and compatibility

Written for: GitHub Copilot

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download audit-integrity.zip