skilld
All skills
github avatar

/audit-integrity

@c5a2d81 official
by githubgithub/awesome-copilot40k stars
5,040

Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.

Ask your Agent

Use this Skill: https://skilld.dev/gh/github/awesome-copilot/audit-integrity

This session only. Nothing lands on disk.

referencesself-reflection-quality-gate.md

≈1.2k tokens on demand. Your agent reads this file only when SKILL.md points to it.

Self-Reflection Quality Gate

After you complete the analysis, score the output across domain categories on a 1–10 scale.

Threshold: Every category must score ≥ 8 to pass. If any category scores < 8, resolve the gaps before you deliver the report (maximum 2 rework iterations).

Core Scoring Rubric (Universal)

Category Score 9–10 Score 7–8 Score 5–6 Score 1–4
Completeness All phases, categories, boundaries, and checklists evaluated with explicit evidence Minor omissions that do not affect the risk profile Noticeable gaps in coverage; entire sections omitted Superficial pass; major sections missing
Accuracy Precise file:line references, confirmed CVE IDs, verified taint flows, correct CWE mappings Minor version ambiguity or indirect references; core findings correct Plausible findings with unverified details or questionable mappings Fabricated references, wrong CWE mappings, or hallucinated CVEs
Actionability Concrete remediation code, exact package upgrade targets, step-by-step guidance Clear direction but requires human adjustment High-level advice without code or version targets Generic platitudes ("sanitize inputs", "keep packages updated")
Consistency Risk ratings match evidence, framework verdicts align with findings, formatting uniform Minor formatting or taxonomy inconsistencies Severity ratings conflict with impact descriptions Contradictory findings or incompatible verdicts
Evidence Rigor Every claim backed by code, manifest, trace, or threat model element Most findings backed; some secondary claims lack citations Assertions made without code citations Speculative findings with zero code or manifest backing

Scoring Threshold

Final Score Action
All categories ≥ 8 PASS — Proceed to final delivery
Any category < 8 (attempt 1) REWORK — Address deficiencies and re-score
Any category < 8 (attempt 2) REWORK — Final attempt to resolve gaps
Any category < 8 (attempt 3) FLAG & DELIVER — Deliver with explicit quality gap disclosure to user

Domain-Specific Rubrics

SAST/SCA

Category Question Threshold
Completeness Did you evaluate all SAST flaw categories and SCA ecosystems? ≥ 8
Accuracy Are findings supported by concrete taint traces and verified CVE IDs? ≥ 8
Actionability Does each Critical and High finding have a concrete code fix or upgrade step? ≥ 8
Consistency Are severity ratings, CWE mappings, and policy verdicts consistent across the report? ≥ 8
Coverage Did you trace all entry points from source to sink and audit all dependency manifests? ≥ 8

Threat Modeling and Code Review

Category Question Threshold
Completeness Did you evaluate all six STRIDE categories for each trust boundary and data flow? ≥ 8
Coverage Were all entry points, trust boundaries, and data flows traced from source to sink? ≥ 8

Source: SKILL.md on GitHub

Third-party checks

No alerts2d3 checks · Risk SAFE
  • Gen Agent Trust Hub2d

    The skill is a comprehensive security audit framework designed for AppSec agents to ensure high-quality and honest reporting. It establishes non-negotiable behaviors, such as prohibiting the fabrication of findings and unauthorized source code modifications. The primary security concern is the inherent surface for indirect prompt injection, as the skill processes untrusted source code and incorporates findings into a persistent memory system without defined boundary markers or input sanitization.

  • Socket2d

    No alerts

  • Snyk2d

    Risk: LOW · No issues

Provenance

Signed by skilld at c5a2d81. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 3 days ago

Capability

metadata
{
  "version": "1.1"
}

Topics

  • appsec
  • audit
  • quality-gates
  • security-analysis
  • sast
  • threat-modeling
  • code-review
  • self-critique
  • integrity
  • agent-framework

README badge

README badge for github/awesome-copilot/audit-integrity

What it does

Enforces output quality and intellectual honesty across AppSec agents through anti-rationalization guards, self-critique loops, retry protocols, and a self-reflection quality gate with ≥8 scoring threshold. Provides seven reusable components (clarification protocol, quality gates, self-learning system) that agents apply before delivery and adapt to domains like SAST, threat modeling, and code review.

Generated from the current SKILL.md.

Frequently asked

Does this skill work with any language or framework?
Yes. The skill is cross-platform and applies to any language or framework analyzed by AppSec agents — SAST, SCA, threat modeling, and code quality analysis.
What happens if a tool fails during analysis?
The Retry Protocol component handles tool failures by retrying once, then documenting the failure if it persists.
Can I customize this skill for my specific agent type?
Yes. Each agent customizes the Self-Critique Loop checklist and Self-Reflection Quality Gate categories to match its domain — SAST/SCA, threat modeling, code review, or other AppSec workflows.
What is the quality threshold for output before delivery?
The Self-Reflection Quality Gate requires all categories to score 8 or higher on a 1–10 rubric before the analysis is delivered.
Does this skill create records of lessons learned?
Yes. The Self-Learning System captures lessons and memories for novel findings, false positives, and methodology gaps with governance rules for governance and reuse.

Generated from the current SKILL.md. These answers refresh after source changes.