audit-skills: a code audit skill for Claude and Codex

Five things, and nothing else

The project states its scope as a list of five things, and the design principle is minimalism, with the description calling it a lightweight skill that only handles the security boundary. The five are a default output directory convention, component vulnerability scanning, Java and .NET language reference plus decompilation and deobfuscation, determining whether a vulnerability is genuinely valid, and the security boundary itself. The primary language is recorded as Python, the licence is not stated in the repository metadata, the last push was on 2026-06-16, and the releases are v0.6.3 with the note Rename to audit-skills, v0.6.2 with the note about strengthening the audit flow and component scanning, and v0.6.1 with the note about expanding the installation and usage instructions. The whole repository is a README and a `skills/` directory, which is the shape of a skill package rather than a program.

Installing it, and the layout it expects

The installation is a directory copy. You place the whole `skills/audit-skills/` directory from this repository into a `.skills/` directory that Claude or Codex recognises, and the coverage is Java, .NET and PHP auditing. The resulting layout is:

.skills/
└── audit-skills/
    ├── SKILL.md
    ├── references/
    │   ├── java.md
    │   ├── net.md
    │   └── java-vulnerability.yaml
    └── scripts/

The layout tells you how the skill is put together. `SKILL.md` is the entry point that the agent reads, the `references/` directory holds the per-language material, with a Java reference, a .NET reference and a YAML file of Java vulnerability patterns, and `scripts/` holds the executable helpers. The separation of the reference documents from the entry point is the pattern that lets the skill stay small, since the agent loads the main file and pulls in a language reference only when the target code is in that language.

The prompting requirement, which is not optional

The usage section carries a constraint that is easy to miss and that changes how you work with the skill. When using this skill you must have a strong direction, with the example given being a question such as whether an SQL injection vulnerability exists. The documented invocations are all of that shape. You can ask the skill to map out the routing information in the current source and output a Markdown routing report, or to map out the authentication information including the authentication mechanism, permission configuration and the route-to-authorization mapping, or to check whether SQL injection exists, or whether deserialization vulnerabilities exist, with a variant that says the multi-agent form may be used to distribute the audit tasks, or to analyse whether middleware and components are vulnerable to path traversal. The point of the requirement is that the skill is a procedure for answering a specific question, and a vague request produces a vague survey.

The Codex orchestration prompt, and the reporting contract

The documented way to drive the skill with Codex is a `/goal` prompt that casts the agent as an audit orchestrator, and it is the most detailed artefact in the repository. The steps are to read SKILL.md fully and follow its rules for invoking the Claude CLI, then enumerate the target repository's language, framework, entry points, routes, permission model, data flow, dangerous functions, configuration and dependencies. The audit is then split into vulnerability types, with each call to the Claude CLI auditing only one type, and each round required to output only findings for the current type rather than generalising. Every round's result must contain the vulnerability type, risk level, file path, line number, reachable path, trigger condition, attack method, impact, evidence, remediation advice, confidence, and whether dynamic verification is needed. The orchestrator then reviews the results, deduplicates, reduces noise, excludes false positives, and merges them into a composite report.

The report shape, and the covered-but-clean categories

The final report is specified, and the last requirement is the one that makes the output useful. It is sorted by severity and it must explicitly list confirmed vulnerabilities, suspected vulnerabilities, audit items where nothing was found but which were covered, and audit blind spots. That fourth category is unusual and is the real value of the format. A report that only says what it found cannot be distinguished from a report that did not look, and a review of an audit that cannot tell you which categories were checked and which were not is not reviewable. Listing the covered-but-clean categories turns the report into a coverage map, which is what makes it possible to commission the missing checks deliberately rather than by accident.

The permission boundary, which is the point of the project

The permission rules in the Codex prompt are the substance of the skill rather than a disclaimer. By default only read-only auditing is allowed. The agent may not modify code, delete files, commit to git, install dependencies, download from the network or run destructive commands. If a command must be executed, it is only allowed to read project information, search code, run read-only tests or perform static analysis. And the `--dangerously-skip-permissions` flag is not to be used unless the user explicitly authorises it and the environment is isolated. The security boundary is also the fifth of the five things the skill claims to do, which is why the name and the design are the same idea. The read-only default is what makes it reasonable to point the skill at a repository that matters, and it is a property of the instructions rather than of an enforcement mechanism, so a user who relaxes the prompt relaxes the guarantee.

Editorial conclusion

Adopt audit-skills if you want an agent to audit a codebase against a fixed checklist with consistent reporting, since the skill's value is the procedure rather than the model. Skip it if you need an automated scanner that runs in CI, because this is prompt material for an agent and not a tool you execute. Before you install, note that the skill expects a strongly directed request rather than an open-ended one, and read the permission rules it ships with, because they default to read-only auditing and forbid code changes, file deletion, git commits, dependency installation and network downloads unless you authorise them.

Frequently asked questions

Official sources

1. Issues
2. README
3. Releases
4. RuoJi6/audit-skills on GitHub