audit-run

Name the audit subject or its identifier, such as "audit the data model" or "A-07". The skill resolves the request to exactly one audit in the A-01 to A-22 index, loads its specification, collects evidence, and produces a report.

The programme covers system inventory, onboarding, dependencies, repository history, static analysis, type safety, tests, development process, module boundaries, data model, API contracts, integrations, frontend architecture, security, performance, observability, CI/CD, reliability, cost, documentation, accessibility, and privacy.

No. The audit is strictly read-only: it never edits, commits, branches, or installs packages into the audited project. The only writes are the two report files under the output directory, plus optional tooling in a temporary directory outside the repository.

Each run produces a Markdown report and a rendered PDF sharing the same content, plus a machine-readable JSON findings register with severity, confidence, category, effort, and evidence fields. A verifier checks that finding identifiers match across prose, register, and PDF before release.

The audit still runs. It derives what it can, records the missing input in the Limits of confidence section, and lowers the confidence rating accordingly rather than refusing to start.

The run stops and reports the discovery immediately in the next message, giving the path, the credential type, and the fact of discovery, never the value. It then continues the audit and files the finding as severity S0.