skilld
All skills
github avatar

/audit-integrity

@c5a2d81 official
by githubgithub/awesome-copilot40k stars
5,040

Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.

Ask your Agent

Use this Skill: https://skilld.dev/gh/github/awesome-copilot/audit-integrity

This session only. Nothing lands on disk.

referencesnon-negotiable-behaviors.md

≈303 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Non-Negotiable Behaviors

These rules apply to all security agents with no exceptions:

  1. Never fabricate findings: Do not report vulnerabilities, threats, bugs, or risk assessments without direct evidence from the scanned code, architecture, or manifests.

  2. Always cite evidence: Every finding must reference a specific file path, line number, CVE ID, component, or trust boundary. Do not output generic findings.

  3. Explain rationale for risk decisions: When you assign severity or policy compliance verdicts, state the reasoning based on exploitability and impact. Do not rely on unexplained judgment.

  4. Do not modify source files: Do not alter code, configuration, dependency files, or manifests unless the user explicitly requests changes.

  5. Report honestly on coverage gaps: If any phase cannot be completed due to missing files or unsupported languages, state it explicitly. Do not omit phases.

  6. Complete all phases: Execute all analysis phases. If a phase is blocked, document the reason and continue with the remaining phases.

  7. Provide progress summaries: For multi-phase scans, summarize findings after completing each major phase before you proceed.

Source: SKILL.md on GitHub

Third-party checks

No alerts2d3 checks · Risk SAFE
  • Gen Agent Trust Hub2d

    The skill is a comprehensive security audit framework designed for AppSec agents to ensure high-quality and honest reporting. It establishes non-negotiable behaviors, such as prohibiting the fabrication of findings and unauthorized source code modifications. The primary security concern is the inherent surface for indirect prompt injection, as the skill processes untrusted source code and incorporates findings into a persistent memory system without defined boundary markers or input sanitization.

  • Socket2d

    No alerts

  • Snyk2d

    Risk: LOW · No issues

Provenance

Signed by skilld at c5a2d81. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 3 days ago

Capability

metadata
{
  "version": "1.1"
}

Topics

  • appsec
  • audit
  • quality-gates
  • security-analysis
  • sast
  • threat-modeling
  • code-review
  • self-critique
  • integrity
  • agent-framework

README badge

README badge for github/awesome-copilot/audit-integrity

What it does

Enforces output quality and intellectual honesty across AppSec agents through anti-rationalization guards, self-critique loops, retry protocols, and a self-reflection quality gate with ≥8 scoring threshold. Provides seven reusable components (clarification protocol, quality gates, self-learning system) that agents apply before delivery and adapt to domains like SAST, threat modeling, and code review.

Generated from the current SKILL.md.

Frequently asked

Does this skill work with any language or framework?
Yes. The skill is cross-platform and applies to any language or framework analyzed by AppSec agents — SAST, SCA, threat modeling, and code quality analysis.
What happens if a tool fails during analysis?
The Retry Protocol component handles tool failures by retrying once, then documenting the failure if it persists.
Can I customize this skill for my specific agent type?
Yes. Each agent customizes the Self-Critique Loop checklist and Self-Reflection Quality Gate categories to match its domain — SAST/SCA, threat modeling, code review, or other AppSec workflows.
What is the quality threshold for output before delivery?
The Self-Reflection Quality Gate requires all categories to score 8 or higher on a 1–10 rubric before the analysis is delivered.
Does this skill create records of lessons learned?
Yes. The Self-Learning System captures lessons and memories for novel findings, false positives, and methodology gaps with governance rules for governance and reuse.

Generated from the current SKILL.md. These answers refresh after source changes.