# Audit Toolkit

> Use when you want to audit, review, harden, ship, or remediate a codebase but are not sure which audit/review/fix skill to reach for — the single index and decision-router for the whole audit-and-fix toolkit. Triggers include "audit this", "review the codebase", "is this ready", "what audit should I run", "harden this", "find issues and fix them", "release readiness", "deep quality review", or any broad ask to assess or improve an existing project's quality, security, docs, or shippability.

- Skill: `b4r7x/audit-toolkit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add b4r7x/audit-toolkit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/b4r7x/audit-toolkit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: b4r7x (https://skillmd.com/u/b4r7x)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/b4r7x/audit-toolkit

---


# Audit Toolkit

## Overview

One entry point that maps the entire audit-and-fix toolkit and routes you to the right skill for your goal. It does NOT load every skill — that would blow the context window. It names the skills by purpose so you (or the human) pick the one that fits, then invoke that skill directly. Pick by GOAL, not by running everything.

## When to use / when NOT

**Use when:** the human wants to assess or improve an existing project but has not named a specific dimension; you need to decide between a quick readiness gate, a deep audit, a focused single-dimension pass, or a full audit-to-fix pipeline.

**Do NOT use when:** the dimension is already obvious — invoke that skill directly (e.g. "is the docs site deployable?" → **docs-deploy-readiness**; "review this PR" → **code-audit** or a normal review). This is a router, not a step in any pipeline.

## Decision router — goal → reach for

| Your goal | Reach for |
|---|---|
| One go/no-go answer: "is it ready to ship?" | **release-audit** (detects shape, dispatches the right dimensions, one scorecard + blockers) |
| Deep audit → prioritized fix-spec → execute the fixes | **nuke-audit** (audit→spec), then **nuke-exec** (execute the spec — formerly nuke-fix) |
| Run a large audit that must CONVERGE and survive usage limits / crashes | **convergence-loop** (the orchestration engine this repo's focused audits run on) |
| Is a publishable artifact (package/library/SDK/CLI/registry) handoff-ready? | **handoff-readiness** |
| Is a docs / content site deploy-ready (coverage, accuracy, SEO, prose)? | **docs-deploy-readiness** |
| What attack surface does this expose (web / local server / CLI / lib / deploy)? | **security-surface-audit** (audit of exposure) · **security-review** (implementation-time checklist) |
| Internal codenames / jargon leaking onto public or reusable surfaces? | **jargon-leak** |
| Cross-package duplication, missed reuse, consolidation targets | **reusability-audit** |
| DRY / SRP / naming / dead code / types / errors across the codebase | **code-audit** |
| AI-slop: filler comments, over-engineering, defensive over-coding | **anti-slop** (audit) · **anti-slop-fix** (auto-fix) |
| Maximum-rigor quality / correctness sweep on critical code | **nuke-audit** in full mode |
| Apply state-of-the-art bar to whatever you are building or reviewing | **sota** (before) · **sota-verify** (after implementing a spec) |
| User-facing prose reads machine-generated | **humanizer** (any text) · **humanize-readme** (READMEs) |
| React code quality | **react-senior-guide** (+ its subskills) |
| Accessibility conformance of a UI | **accessibility-compliance** |
| Test quality / behavior-vs-implementation | **test-behavior-not-implementation** |

## The pipeline

For a project you intend to release, the tools compose into a pipeline — use as much of it as the goal needs:

```text
release-audit        quick gate: is it ready? scorecard + ship-blockers (stop here if you only need a verdict)
      │ NOT READY and you want it fixed
      ▼
nuke-audit           deep multi-round audit → converged findings ledger → prioritized fix-spec
      │              (has its own convergence loop; pulls dimension content from the focused + library skills above)
      ▼
nuke-exec            execute the fix-spec phase by phase, fresh-agent validation per phase, gates green
      ▼
sota-verify          confirm the implemented spec meets the bar; loop until clean
      ▼
(human/runtime)      the things static analysis cannot prove: clean-env build, publish smoke,
                     deploy dry-run, live perf, real screen-reader pass
```

The focused skills (**handoff-readiness**, **docs-deploy-readiness**, **security-surface-audit**, **jargon-leak**) and the library skills (**code-audit**, **reusability-audit**, **anti-slop**, **humanizer**, **react-senior-guide**, **accessibility-compliance**) are the DIMENSIONS that **release-audit** and **nuke-audit** dispatch — you can also run any of them standalone when you only care about that one dimension.

## How to pick (fast)

1. **Just want a verdict?** → **release-audit**. Done.
2. **Want it actually fixed?** → **nuke-audit** → **nuke-exec**.
3. **One known dimension?** → invoke that focused/library skill directly (router table above).
4. **Big codebase, long run, limit-prone?** → whichever audit, but make sure it runs on **convergence-loop**.

## Common mistakes

- **Trying to load everything.** This skill is a map, not a bundle. Force-loading 15 skills blows the context window. Name and invoke the ONE that fits the goal.
- **Deep audit when a gate would do.** If the human only wants go/no-go, **release-audit** answers in one pass — don't spin up **nuke-audit**.
- **Gate when they wanted fixes.** "Is it ready?" → release-audit. "Make it ready" → nuke-audit → nuke-exec. Match the verb.
- **Skipping the runtime caveats.** No static audit proves a clean-environment build, a publish smoke, or a screen-reader pass. Always hand those to the human.
- **Referencing skills via @-paths.** Name them; @-paths force-load and burn context.