audit

Measures a repository against a spec and reports gaps without writing code.

Updated Aug 25, 2026
One-click install
npx skills add https://github.com/AiFirstDevelopment/quorum --skill audit-aifirstdevelopment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit
Source: https://github.com/AiFirstDevelopment/quorum/tree/main/plugins/quorum/skills/audit
Command: npx skills add https://github.com/AiFirstDevelopment/quorum --skill audit-aifirstdevelopment

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams need to know whether an existing repository faithfully implements a given specification, but manual review is slow and self-review by the same AI that wrote the code is unreliable. This Skill audits a repo against a spec — supplied as free text or a file path — and produces a verifiable report of met, gap, and unverified criteria, all without modifying the code under audit. ## Core Features & Use Cases - Spec-to-criteria derivation: Converts a specification into numbered, observable criteria, each citing its source, and gates the run on user approval of that list. - Read-only multi-agent audit: Fans out read-only auditor agents per criteria cluster, runs a refutation pass on a different model for every claimed gap, and has a scribe write the final report. - Tamper-evident verification: Records a hash of the approved criteria and verifies the report cites that same hash, so softened criteria are detectable. - Use Case: Point it at a repo that never used the pipeline and a spec file like docs/specs/billing-api.md; it writes docs/audit/<slug>/ with criteria.md and report.md, listing each gap as an acceptance criterion ready for planning. ## Quick Start Ask the AI to audit this repository against the spec at docs/specs/billing-api.md and report where the implementation falls short.

Frequently Asked Questions about audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check whether a repository implements a spec?▼

Run the audit with the spec as free text or a path to a spec file in the repo. It derives observable criteria from the spec, gets your approval, then measures the code and writes a report of met, gap, and unverified criteria under docs/audit/<slug>/.

Can I run a spec audit on the main branch safely?▼

Yes. This audit is built for the default branch because it writes no code: it creates no branch, makes no commit, never executes the repository, and writes only under docs/audit/. A final git status check confirms nothing else changed.

Does the audit execute the repository's code or tests?▼

No. The audit never runs the application, build, test suite, or any shipped script. Auditor agents hold only Read, Grep, and Glob. Criteria that depend on runtime behavior come back marked unverified rather than met.

What happens if the spec file path I give does not exist?▼

The audit stops, names the path it looked for, and writes nothing. It offers to search for the file or accept the spec as pasted text, and never treats a missing path string as the spec itself.

How does the audit prove the report matches the approved criteria?▼

The approved criteria list is hashed and recorded in criteria.md. After the run, a verify command checks that criteria.md still hashes to the recorded value and that report.md cites the same hash, exiting non-zero on any mismatch.

What are the limitations of a read-only spec audit?▼

It can only confirm the code appears to implement a requirement, not that the software behaves correctly at runtime. Extra implementation beyond the spec is never reported as a finding, and general code review unrelated to criteria is out of scope.