skilld
All skills
github avatar

/audit-integrity

@c5a2d81 official
by githubgithub/awesome-copilot40k stars
5,040

Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.

Ask your Agent

Use this Skill: https://skilld.dev/gh/github/awesome-copilot/audit-integrity

This session only. Nothing lands on disk.

referencesself-critique-loop.md

≈402 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Self-Critique Loop

After you complete the initial analysis, complete a mandatory second pass before you deliver the report.

Universal Checks

  1. Evidence check: Every finding must cite a verified reference (file:line, component, architecture element, or CVE ID). Remove any finding that does not have supporting evidence.
  2. Coverage check: Verify that you evaluated all required categories and phases. State "None detected" for clean categories. Do not omit clean categories.
  3. Remediation check: Provide a specific, implementable fix for every Critical and High finding. Do not provide generic recommendations.

Domain Checks

SAST/SCA

  1. Taint trace completeness: Verify that you traced each discovered entry point from source to sink.
  2. Manifest coverage: Verify that you audited all discovered dependency manifests.
  3. Evidence completeness: Cite a verified file:line reference and taint trace for each SAST finding. Cite a verified CVE ID and affected version range for each SCA finding.
  4. Flaw category completeness: Confirm that you evaluated all flaw categories. State "No instances detected" for clean categories. Do not omit clean categories.
  5. Policy consistency: Verify that the PASS or FAIL policy verdict matches severity counts and policy threshold rules.

Threat Modeling

  1. STRIDE completeness: Verify that you evaluated all six STRIDE categories (S/T/R/I/D/E) for each trust boundary and data flow.
  2. Trust boundary audit: Verify that each identified trust boundary has at least one evaluated data flow crossing it.

Source: SKILL.md on GitHub

Third-party checks

No alerts2d3 checks · Risk SAFE
  • Gen Agent Trust Hub2d

    The skill is a comprehensive security audit framework designed for AppSec agents to ensure high-quality and honest reporting. It establishes non-negotiable behaviors, such as prohibiting the fabrication of findings and unauthorized source code modifications. The primary security concern is the inherent surface for indirect prompt injection, as the skill processes untrusted source code and incorporates findings into a persistent memory system without defined boundary markers or input sanitization.

  • Socket2d

    No alerts

  • Snyk2d

    Risk: LOW · No issues

Provenance

Signed by skilld at c5a2d81. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 3 days ago

Capability

metadata
{
  "version": "1.1"
}

Topics

  • appsec
  • audit
  • quality-gates
  • security-analysis
  • sast
  • threat-modeling
  • code-review
  • self-critique
  • integrity
  • agent-framework

README badge

README badge for github/awesome-copilot/audit-integrity

What it does

Enforces output quality and intellectual honesty across AppSec agents through anti-rationalization guards, self-critique loops, retry protocols, and a self-reflection quality gate with ≥8 scoring threshold. Provides seven reusable components (clarification protocol, quality gates, self-learning system) that agents apply before delivery and adapt to domains like SAST, threat modeling, and code review.

Generated from the current SKILL.md.

Frequently asked

Does this skill work with any language or framework?
Yes. The skill is cross-platform and applies to any language or framework analyzed by AppSec agents — SAST, SCA, threat modeling, and code quality analysis.
What happens if a tool fails during analysis?
The Retry Protocol component handles tool failures by retrying once, then documenting the failure if it persists.
Can I customize this skill for my specific agent type?
Yes. Each agent customizes the Self-Critique Loop checklist and Self-Reflection Quality Gate categories to match its domain — SAST/SCA, threat modeling, code review, or other AppSec workflows.
What is the quality threshold for output before delivery?
The Self-Reflection Quality Gate requires all categories to score 8 or higher on a 1–10 rubric before the analysis is delivered.
Does this skill create records of lessons learned?
Yes. The Self-Learning System captures lessons and memories for novel findings, false positives, and methodology gaps with governance rules for governance and reuse.

Generated from the current SKILL.md. These answers refresh after source changes.