skilld
All skills
github avatar

/audit-integrity

@c5a2d81 official
by githubgithub/awesome-copilot40k stars
5,040

Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.

Ask your Agent

Use this Skill: https://skilld.dev/gh/github/awesome-copilot/audit-integrity

This session only. Nothing lands on disk.

referencesself-learning-system.md

≈571 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Self-Learning System

Maintain project learning artifacts in .github/SecurityLessons/ and .github/SecurityMemories/.

When to Create

Lesson

Create a lesson when:

  • A scan produces a false positive that required manual correction
  • A finding category, STRIDE category, or flaw type is missed on first pass and caught by the self-critique loop
  • A tool or methodology limitation is discovered
  • A language-specific rule misfires
  • An SCA dependency cannot be resolved

Memory

Create a memory when:

  • An architecture decision, security convention, or technology stack detail is discovered
  • A dependency management pattern, domain-specific threat pattern, or threat actor profile is identified
  • A project coding convention, framework idiom, or known false-positive pattern is found
  • Any codebase-specific knowledge would be useful for future scans of the same codebase

Lesson Template

# Security Lesson: <short-title>

## Metadata

- CreatedAt: <date>
- Status: active | deprecated
- Supersedes: <previous lesson if any>

## Context

- Triggering scan/task:
- Component analyzed:

## Issue

- What went wrong or was missed:
- Expected behavior:
- Actual behavior:

## Root Cause

- Why was this missed or incorrect:

## Resolution

- How it was corrected:

## Preventive Guidance

- How to avoid this in future scans:

Memory Template

# Security Memory: <short-title>

## Metadata

- CreatedAt: <date>
- Status: active | deprecated
- Supersedes: <previous memory if any>

## Context

- Triggering scan/task:
- Scope/system:

## Key Fact

- What was discovered:
- Why it matters for security analysis:

## Reuse Guidance

- When to apply this knowledge:
- Related components:

Governance Rules

  1. Dedup check: Before creating a new lesson or memory, search existing files for similar content. Update existing records rather than creating duplicates.
  2. Conflict resolution: If new evidence conflicts with an existing active lesson/memory, mark the older one as deprecated and create the updated version with a Supersedes reference.
  3. Reuse at scan start: At the start of every analysis, check the lessons/memories directory for applicable context. Apply relevant guidance before beginning analysis.

Source: SKILL.md on GitHub

Third-party checks

No alerts2d3 checks · Risk SAFE
  • Gen Agent Trust Hub2d

    The skill is a comprehensive security audit framework designed for AppSec agents to ensure high-quality and honest reporting. It establishes non-negotiable behaviors, such as prohibiting the fabrication of findings and unauthorized source code modifications. The primary security concern is the inherent surface for indirect prompt injection, as the skill processes untrusted source code and incorporates findings into a persistent memory system without defined boundary markers or input sanitization.

  • Socket2d

    No alerts

  • Snyk2d

    Risk: LOW · No issues

Provenance

Signed by skilld at c5a2d81. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 3 days ago

Capability

metadata
{
  "version": "1.1"
}

Topics

  • appsec
  • audit
  • quality-gates
  • security-analysis
  • sast
  • threat-modeling
  • code-review
  • self-critique
  • integrity
  • agent-framework

README badge

README badge for github/awesome-copilot/audit-integrity

What it does

Enforces output quality and intellectual honesty across AppSec agents through anti-rationalization guards, self-critique loops, retry protocols, and a self-reflection quality gate with ≥8 scoring threshold. Provides seven reusable components (clarification protocol, quality gates, self-learning system) that agents apply before delivery and adapt to domains like SAST, threat modeling, and code review.

Generated from the current SKILL.md.

Frequently asked

Does this skill work with any language or framework?
Yes. The skill is cross-platform and applies to any language or framework analyzed by AppSec agents — SAST, SCA, threat modeling, and code quality analysis.
What happens if a tool fails during analysis?
The Retry Protocol component handles tool failures by retrying once, then documenting the failure if it persists.
Can I customize this skill for my specific agent type?
Yes. Each agent customizes the Self-Critique Loop checklist and Self-Reflection Quality Gate categories to match its domain — SAST/SCA, threat modeling, code review, or other AppSec workflows.
What is the quality threshold for output before delivery?
The Self-Reflection Quality Gate requires all categories to score 8 or higher on a 1–10 rubric before the analysis is delivered.
Does this skill create records of lessons learned?
Yes. The Self-Learning System captures lessons and memories for novel findings, false positives, and methodology gaps with governance rules for governance and reuse.

Generated from the current SKILL.md. These answers refresh after source changes.