finding-forensic-remediation

Converts audit findings into a prioritized remediation backlog using code and git forensics.

3|1|Updated Apr 8, 2026
One-click install
npx skills add https://github.com/ever-just/agentskills --skill finding-forensic-remediation-ever-just
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: finding-forensic-remediation
Source: https://github.com/ever-just/agentskills/tree/main/skills/finding-forensic-remediation
Command: npx skills add https://github.com/ever-just/agentskills --skill finding-forensic-remediation-ever-just

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Audit reports that only say "X is broken" leave engineers guessing about root cause, whether the bug is still live, and what exactly to change. This Skill turns a descriptive findings list into an actionable, diff-level remediation backlog by confirming each issue in current code and tracing its history through git. ## Core Features & Use Cases - Per-finding forensics: Re-locates each issue at the current path:line, uses git blame and git log -S to find the introducing commit, and checks later commits and uncommitted diffs for partial fixes. - Status classification: Assigns each finding a status (outstanding, partially_fixed, fixed_undeployed, fixed_deployed, not_reproducible) anchored to a deploy baseline established from HEAD and origin. - Prioritized backlog output: Produces P0-P3 priorities, exact before→after fixes, regression tests, effort estimates (S/M/L), quick wins, and fix sequencing guidance. - Use Case: After running a production agent audit that flagged 20 issues, use this Skill to verify which are still live on the deployed code, identify three S-effort quick wins, and hand engineers a backlog they can start from cold. ## Quick Start Take the findings from my last audit and produce a prioritized remediation backlog with git-blame evidence, current path:line references, and exact before-and-after fixes for each issue.

Frequently Asked Questions about finding-forensic-remediation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I make an audit report actionable for engineers?▼

Convert each finding into a backlog item with the confirmed current path:line, the commit that introduced it, a status based on git evidence, and an exact before-to-after fix with a regression test and effort estimate. Prioritize items P0 through P3 by blast radius.

How do I check if a bug from an audit is still live?▼

Establish a deploy baseline with git rev-parse HEAD and git status, then re-locate the issue by symbol in current code rather than trusting old line numbers. Use git log --since and git show on later commits to see whether any change actually fixed it.

How do I find which commit introduced a bug?▼

Use git blame -L on the relevant line range or git log -S'<symbol>' to find when the construct first appeared. Report the introducing commit hash, date, and message, then read the actual diff rather than trusting commit messages.

Can I trust an uncommitted local fix before deploying?▼

Not without review. An uncommitted change is not deployed under a push-to-main model, and a broad guard-bypass can worsen the very issue it claims to fix. Inspect git diff for the file and flag changes that should not ship as-is.

What are the limitations of commit-message-based verification?▼

A commit message claiming a fix is not proof the fix works. The method requires reading the actual diff and current code, and preferring a live reproduction, since messages like "fix: empty PDF pages" may not address the real mechanism.