godaudits
SolidAudit an existing codebase end to end and emit validated machine state plus a standalone remediation report. godaudits fingerprints the repository, detects six project forms and conservative overlays, validates Pillars 1.1 and arc-ready artifacts, evaluates 431 checks across 18 domains in an explicit pass/fail/unknown/not-applicable ledger, records hashed secret-safe evidence, covers OWASP Web Top 10:2025, adversarially verifies findings, computes scores with coverage and risk caps, and renders MDX plus optional SARIF from AUDIT.json. Includes deterministic validation, evaluations, focused and re-audit modes, and godplans conformance. Static mode is read-only and never runs the app, tests, live systems, network, or models. Use for audits, health checks, due diligence, production readiness, re-audits, and remediation planning. Refuses stale evidence, unverifiable citations, unredacted secrets, unsupported regulatory claims, double-billing, and Critical or High findings without executable tasks.
Install
Quality Score: 79/100
Skill Content
Details
- Author
- hannsxpeter
- Repository
- hannsxpeter/godaudits
- Created
- 3 weeks ago
- Last Updated
- 4 days ago
- Language
- JavaScript
- License
- MIT
Similar Skills
Semantically similar based on skill content — not just same category
godplans
Produce an audit-aware, agent-executable master plan (PLAN.mdx) for a software project before application code is written. One command runs discovery, forces hard-to-reverse decisions, and plans product, architecture, roadmap, stack, repo, build, deploy, observability, launch, security, code quality, style genome, database, LLM integration, SEO, UI, UX, and agent memory upfront. After-the-fact audit checks become plan-time acceptance criteria, and a self-contained validator enforces task structure and approval state. Use when the user says: plan this project, godplans, master plan, plan everything upfront, idea to plan, plan before code, audit-aware plan, replan, or starts a greenfield project or major feature. Refuses plan theater (sections filled, decisions absent), vague tasks without verification, unsupported quality guarantees, and projects whose core purpose violates the Anthropic Usage Policy.
auditsmith
Use when auditing, reviewing, or assessing an application's codebase — including narrower phrasings like 'review my code', 'is this secure', 'is this production ready', 'why is this slow', 'check my error handling', 'is my LLM integration safe', 'find issues in this repo', or 'what am I missing before launch'. Covers ten areas — UX behavior, code quality, UI, security, LLM/AI usage, performance, testing, dependencies, observability, API contracts. Detects auth/authz gaps, IDOR, injection, secrets, SSRF, prompt injection, race conditions, missing error handling, empty states, N+1 queries, bundle bloat, memory leaks, flaky tests, CVEs, idempotency gaps, missing logging/alerting. Contexts — pre-launch, handover, client delivery, code review, refactor planning. Outputs findings with file:line evidence, severity ranking, and CI/lint rules to prevent regression. Stacks — React, TypeScript, Node, Python, Go, Cloudflare Workers.
audit
Read-only quality gate that audits already-built work against its stated requirement and Definition of Done before it is allowed to move to 2_done/. Produces a severity-ranked decision proposal (BLOCKER/MAJOR/MINOR/NIT) with evidence, never a fix. Use when an item is claimed complete, before moving anything to 2_done/, when asked to audit or review finished work for completeness against requirements, or when acting as the dedicated post-completion review subagent. This gate is mandatory in every session mode. Not for diagnosing why something is broken (use diag) and not for verifying rendered UI behavior (use verify).