compliance-audit

Audits task diffs against active rules and skills to flag violations and log compliance.

1|Updated Mar 26, 2026
One-click install
npx skills add https://github.com/arndvs/ctrlshft --skill compliance-audit-arndvs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: compliance-audit
Source: https://github.com/arndvs/ctrlshft/tree/main/skills/compliance-audit
Command: npx skills add https://github.com/arndvs/ctrlshft --skill compliance-audit-arndvs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Loading a rule into an AI agent's context does not guarantee the rule was followed. This Skill closes that gap by reviewing the actual diff produced by a completed task against every rule and skill that was active during the session, making violations visible and recoverable instead of silent. ## Core Features & Use Cases - Rule-by-rule diff audit: Gathers active contexts, rules, and invoked skills, then checks the commit diff against each one with explicit PASS/VIOLATION/UNCLEAR verdicts and severity ratings. - Resource management scanning: Automatically scans JS/TS diffs for anti-patterns like missing cleanup, unbounded Maps, HMR-unsafe module state, and SDK-per-request instantiation, including verification that fixes use valid patterns. - PR review thread auditing: Fetches GitHub PR review threads via GraphQL to validate HITL tier classification and deferral paths in Copilot review rounds, with a degraded fallback mode. - Self-improving loop: Updates the skill or rule inline when a violation reveals an ambiguous rule, and appends results to a persistent compliance log. - Use Case: After a TDD cycle completes and produces a commit, run the audit to confirm the diff follows surgical-changes and framework rules, flag any violations with severity, and log the result for compliance-rate tracking over time. ## Quick Start Ask the agent to run a compliance audit on the most recent commit against the rules and skills active in this session.

Frequently Asked Questions about compliance-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify an AI agent followed coding rules after a task?▼

Run a compliance audit that gathers the active contexts and rules, pulls the commit diff with git diff, and checks each rule against the changes. The audit outputs PASS, VIOLATION, or UNCLEAR verdicts with evidence and severity for every rule.

How to detect memory leaks and missing cleanup in JavaScript diffs?▼

Scan the diff for anti-patterns like addEventListener without cleanup, setInterval without clear, unbounded Maps at module scope, and fetch without AbortController. Each finding is tagged PROD, DEV, or BOTH with a severity and a valid fix pattern.

Can the audit check GitHub Copilot PR review replies?▼

Yes, it fetches PR review threads using gh api graphql or MCP GitHub tools and validates HITL tier classification and deferral paths. If GraphQL is unavailable, a degraded mode checks reply bodies but marks thread resolution as unverifiable.

What happens when the audit finds a rule violation?▼

Violations are flagged with evidence, severity, and remediation guidance. If the rule wording was ambiguous, the skill or rule is updated inline; if the rule was clear, it is recorded as agent non-compliance and logged to working/logs/compliance-log.md.

What are the limitations of automated rule compliance audits?▼

The audit reviews diffs against stated rules and cannot detect subtle semantic violations, such as code that compiles but violates architectural intent. The goal is making violations visible and tracking compliance rate over time, not perfect verification.