AUTOGIO Repository Audit
Objective
Produce an evidence-based, read-only audit of the currently selected repository and write a timestamped report under ~/Reports/RepositoryAudits/.
Invocation
Cursor may auto-invoke this skill when the request matches the description. Slash command also works:
/repository-audit
Scope
Architecture, security, correctness, reliability, dependencies, tests, documentation, macOS/Apple integration (when present), shell scripts (when present), and repository hygiene.
Non-Goals
- No remediation or code changes
- No package installs, dependency updates, deployments, or migrations
- No speculative rewrites or unrelated documentation
Authorized Output
Create only a new timestamped report per output-policy.md:
/Users/giovannini.eduardogmail.com/Reports/RepositoryAudits/repository_audit_<repo-slug>_YYYY-MM-DD_HH-MM-SS.md
Do not write to the repository root, $HOME, or cwd by default. User may override with an absolute path.
Required Inputs
- Current working directory / selected repository
- Optional: absolute output path override
- Optional: user focus areas (security-only, macOS-only, etc.)
Operating Rules
Consult shared framework (do not duplicate):
- Safety Policy
- Output Policy
- Evidence Standard
- Finding Format
- Severity Model
- Execution Policy
- Report Guidelines
Domain references:
- Repository Checks
- macOS Repository Checks
- Shell Script Checks
Report template: repository-audit-report.md
Finding IDs use prefix REPO-.
Workflow
- Resolve output path (default under
~/Reports/RepositoryAudits/; create folder if needed) - Discover repository state and map structure
- Infer purpose from implementation (docs are claims)
- Identify build, test, and run procedures
- Inspect critical paths, security-sensitive code, dependencies, and tests
- Compare documentation with implementation
- Assess architecture, operational stability, hygiene
- When present: macOS components and shell scripts
- Consolidate findings; write the timestamped report (absolute path in header)
- Confirm no application files were changed
Repository Discovery
Safe example commands (filter/exclude large generated dirs):
pwd
git status --short
git branch --show-current
git remote -v
git log -10 --oneline --decorate
git submodule status
du -sh .
find . -maxdepth 3 -type f
find . -maxdepth 3 -type d
git diff --check
Exclude from broad scans: .git, node_modules, Pods, DerivedData, .build, build, dist, vendor, .venv, venv, __pycache__, .cache.
Tests or builds may run only when clearly non-destructive and dependencies already exist.
Build and Runtime Analysis
Identify how the project builds, tests, and runs. Record entry points, scripts, CI config, and whether documented commands match reality.
Correctness Review
Inspect critical execution paths, error handling, state management, and mismatches between intended and actual behavior.
Security Review
Authn/authz, secrets handling, input validation, unsafe shell/network patterns, and exposure surfaces. Redact secrets as [REDACTED].
Dependency Review
Manifests, lock files, outdated or unused deps, multiple package managers, and supply-chain risk indicators. Do not update dependencies.
Testing Review
Coverage of critical paths, missing tests, flaky or non-runnable suites, and CI gaps.
Documentation Review
README and docs vs implementation. Flag ambition–capacity mismatch and stale instructions.
Operational Stability Review
Logging, monitoring, retries/timeouts, backups, migrations, and failure modes.
Architecture Review
Duplicate abstractions, multiple sources of truth, unnecessary complexity, and architecture drift.
macOS Review
When Apple/macOS artifacts exist, follow macos-repository-checks.md.
Shell Script Review
When shell scripts exist, follow shell-script-checks.md. Risky commands need contextual analysis — do not auto-classify as vulnerabilities.
Repository Hygiene
Git status, ignored vs tracked generated files, submodule health, and repo clutter.
Required Report Structure
Use templates/repository-audit-report.md. Include the absolute report path in the header.
Stop Conditions
Stop and report clearly if:
- Repository is inaccessible or not a meaningful project root
- Required inspection would need unauthorized modification or
sudo - Command safety is uncertain
- Secrets would be exposed by continuing a check
Document what was completed, blocked, remaining, and the smallest next action.
Completion Response
- Status, report path
- Findings counts by severity
- Commands skipped or failed
- Highest-priority next action
- Confirmation that application files were not modified