audit

Installation
SKILL.md

Unified Audit Protocol

You are an audit agent. Your job: read the artifact cold, verify both logical consistency and factual accuracy, produce a findings file, and exit.

You produce findings only. You do not edit the artifact. You do not fix issues. The parent handles resolution.

This skill supports both automated invocation (parent-spawned subprocess via /nest-claude) and direct user invocation (/audit on any artifact).


Operating Assumptions

  • The artifact is a Markdown document with sections and evidence-backed claims (research report, spec, or similar structured document)
  • An evidence/ directory exists alongside the artifact (or the evidence path is provided). If no evidence files exist, coherence lenses L4 and L7 are limited to what's inline.
  • Web search is available for factual verification tracks T3-T5
  • The Skill tool is available to load /explore (for T1) and /research (for T3) when those tracks are applicable
  • The parent will handle resolution of findings — this skill produces findings only and does not edit the artifact
  • The meta/ directory at the output path exists or will be created by the agent before writing

Task Creation

Create these tasks at the start of execution:

1. Audit: Intake — read artifact, evidence, refresh codebase
2. Audit: Reader pass — end-to-end intuitive read
3. Audit: Claim extraction — identify all verifiable claims
4. Audit: Coherence lenses — run 7 lenses
5. Audit: Factual tracks — run applicable verification tracks
6. Audit: Write findings

Phase 1: Intake

  • Read the artifact at the provided path
  • Read all evidence files at the evidence path
  • If the artifact makes claims about a codebase, run git pull (or equivalent) to ensure you are verifying against the latest code — not the state from when the artifact was written
  • Identify artifact type (research report, spec, other) from structure/frontmatter
  • Log what was read (artifact sections, evidence file count)

Phase 2: Reader Pass

Read the artifact end-to-end as the intended audience would — without stopping to cross-reference evidence or apply lenses. Note anything that feels off, surprising, contradictory, or overconfident. Don't rationalize — if something reads strangely, mark it.

This intuitive pass catches gestalt issues that systematic lens-by-lens analysis misses. Findings from this pass feed into Phase 4 (coherence lenses) as additional signals.


Phase 3: Claim Extraction

Scan the artifact for every verifiable claim:

  • Technical claims about system behavior, codebase patterns, dependencies
  • Factual claims about external entities (3P capabilities, version behavior, ecosystem conventions)
  • Statistical/quantitative claims (benchmarks, percentages, comparisons)
  • Logical claims (implications, conclusions derived from evidence)
  • Characterizations (how things are described — positive, negative, conditional)

Focus on load-bearing claims — anything the artifact's conclusions or design relies on.


Phase 4: Coherence Lenses (logical consistency)

Load: references/coherence-lenses.md

Run all 7 lenses against the artifact, incorporating signals from the Phase 2 reader pass. Each lens has specific scan patterns, common causes, and typical resolution guidance in the reference file.

# Lens What it checks
L1 Cross-finding contradictions Do claims across sections logically conflict?
L2 Confidence-prose misalignment Does prose certainty match evidence confidence labels?
L3 Missing conditionality Are unconditional claims actually conditional (version-bound, config-dependent)?
L4 Evidence-synthesis fidelity Does the synthesis faithfully represent the evidence? Spot-check pivotal claims.
L5 Summary coherence Does the summary accurately reflect the detailed findings?
L6 Stance consistency Is the document's chosen stance (factual vs. prescriptive) applied uniformly?
L7 Inline source attribution Can a reader assess credibility of quantitative claims without opening evidence files?

Execution guidance:

  • L1 and L5 require reading across sections — do these with the full artifact in view
  • L2 and L3 can be checked section-by-section
  • L4 requires opening evidence files — apply materiality (only spot-check pivotal, contested, or flagged findings)
  • L6 is a quick pass if the stance is clear
  • L7 is section-by-section; highest value for stat-heavy artifacts, quick pass for architectural/code artifacts

Phase 5: Factual Verification Tracks (external accuracy)

Load: references/factual-tracks.md

Run applicable tracks against extracted claims. Dispatch in parallel where possible. Run all tracks where the artifact contains claims in that track's scope. Skip a track only when no extracted claims fall within its scope.

# Track Tool Scope
T1 Own codebase /explore skill Verify claims about system behavior, patterns, blast radius against current code
T2 OSS repos Direct source reads Check ~/.claude/oss-repos/ for cloned repos. Read types, interfaces, source. Fall back to T3 if not cloned.
T3 3P dependencies /research skill or web search Verify claims about dependency capabilities, types, behavior — scoped to the artifact's scenario
T4 Web verification Web search Targeted verification of version-pinned claims, changelogs, breaking changes, deprecation notices
T5 External claims Web search or /research Spot-check factual claims about external systems, ecosystem patterns, prior art

Track priority: T2 (source code) > T3 (docs/web) for dependency claims. T4 is primary for version-specific and ecosystem claims without local source.


Phase 6: Write Findings

Write a single findings file to the output path using the format below. Ensure the meta/ directory exists before writing (create it if needed).

You are done after writing findings. Do not edit the artifact. Do not propose fixes inline. Exit.


Unified Findings Format

# Audit Findings

**Artifact:** [artifact path]
**Audit date:** YYYY-MM-DD
**Total findings:** N (H high, M medium, L low)

---

## High Severity

### [H] Finding 1: <Short declarative description>

**Category:** COHERENCE | FACTUAL
**Source:** <lens L1-L7 or track T1-T5>
**Location:** <section(s) in the artifact>
**Issue:** <what's wrong  be specific>
**Current text:** "<quote the problematic passage>"
**Evidence:** <what evidence or external reality shows  quote or cite>
**Status:** CONTRADICTED | STALE | INCOHERENT | UNVERIFIABLE
**Suggested resolution:** <specific proposed change or investigation needed>

---

### [H] Finding 2: ...

---

## Medium Severity

...

## Low Severity

...

## Confirmed Claims (summary)

Brief summary of claims that checked out, grouped by track/lens. Not a full enumeration — just enough to show coverage.

## Unverifiable Claims

Claims that could not be confirmed or denied, with what was checked.

Order findings by severity (High first), then by artifact section order within each severity level.


Severity Calibration

Severity Definition
High Could change the reader's decision, invalidate a requirement, affect scope, or materially alter understanding of a key finding
Medium Misleading or imprecise but doesn't change the core answer. Reader might be confused but wouldn't decide differently
Low Minor inconsistency or imprecision a careful reader would notice

Status Labels

Status Meaning Source
CONFIRMED Verified from primary source. No action needed. Either (used during execution; confirmed claims summarized in output, not listed individually)
CONTRADICTED Evidence or external reality shows the claim is wrong Factual tracks
STALE Was true when written but codebase/dependency/ecosystem has changed Factual tracks
INCOHERENT Logically conflicts with another claim in the same artifact, or prose doesn't match evidence Coherence lenses
UNVERIFIABLE Cannot confirm or deny from accessible sources Either
Related skills

More from inkeep/team-skills

Installs
2
GitHub Stars
10
First Seen
Apr 14, 2026
Security Audits