Audit Pro

Audit Pro Skill

Runtime Adapter (Codex/Hermes)

This is the portable Codex/Hermes install of Audit Pro. It must run from its own skill folder and must not depend on source-system project paths.

Audit Pro is Codex-native in this portable install: Codex CLI with gpt-5.6-sol at max reasoning is the final audit and verdict authority. Optional cross-model discovery uses Claude CLI and GLM 5.2 through Ollama Cloud. Gemini was retired on 2026-07-05 and must not be dispatched; --gemini-only is a deprecated compatibility alias for --glm-only.

Skill Root

Resolve the skill root from the location of this SKILL.md.

Expected install path patterns:

• Codex agents skill: $HOME/.agents/skills/audit-pro
• Codex local skill: $HOME/.codex/skills/audit-pro
• Hermes main: $HOME/.hermes/skills/audit-pro
• Hermes pilot: $HOME/hermes-pilot/data/skills/audit-pro

For shell scripts, set or infer:

AUDIT_PRO_ROOT="${AUDIT_PRO_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"  # for scripts directly under scripts/

Scripts nested deeper than scripts/ must resolve from their own depth or require AUDIT_PRO_ROOT to be exported by the caller.

The install paths above are documentation examples only. Active scripts must resolve runtime files from AUDIT_PRO_ROOT and configurable environment variables.

Bundled Files

• AUDIT-PRO.md — core procedure and scoring rules.
• commands/audit.md — slash-command reference.
• profiles/*.local.md — portable profile defaults.
• references/*.md — calibration, DSE registry, anti-patterns, false positives.
• scripts/*.sh and scripts/*.py — optional local helpers.
• output/ and state/ — local runtime output.

Execution

1. Read AUDIT-PRO.md.
2. Resolve the target file/directory from the user request.
3. Load profiles/default.local.md unless --profile <name> is provided.
4. Classify target type and audit tier.
5. Run the audit using the bundled procedure and references.
6. Write reports under output/.
7. Write loop/runtime state under state/.

If output/ or state/ is unavailable, return the report inline and state that persistence was skipped.

Optional external integrations are disabled by default. Cross-model mode requires Claude discovery, GLM 5.2 discovery, and Codex/GPT-5.6 Sol reconciliation. Use environment variables or explicit flags only:

• AUDIT_PRO_STORE_URL for a knowledge-store endpoint.
• AUDIT_PRO_EXPORT_DIR for external report export.
• AUDIT_PRO_CODEX_MODEL and AUDIT_PRO_CODEX_REASONING_EFFORT for the Codex authority route.
• CLAUDE_BIN for the Claude discovery lane.
• GLM_MODEL, OLLAMA_CLOUD_BASE_URL, and GLM_MAX_TOKENS for the GLM discovery lane.
• OLLAMA_API_KEY from the environment or macOS Keychain; OLLAMA_ENV_FILE is an explicit optional fallback. Never print the key.

Smoke Checks

The smoke script validates structure, shell/Python syntax, sanitizer redaction behavior, SSH path-shape redaction, portable-mode dry run, and required runtime scaffold directories.

AUDIT_PRO_ROOT="${AUDIT_PRO_ROOT:-$HOME/.codex/skills/audit-pro}"
bash "$AUDIT_PRO_ROOT/scripts/audit-pro-smoke.sh"
bash -n "$AUDIT_PRO_ROOT/scripts/"*.sh
PYTHONPYCACHEPREFIX="${TMPDIR:-/tmp}/audit-pro-pycache" python3 -m py_compile "$AUDIT_PRO_ROOT/scripts/audit-discover.py"
bash "$AUDIT_PRO_ROOT/scripts/glm-audit-dispatch.sh" --preflight

Boundary Rule

This skill is portable only if active execution paths do not contain hardcoded .nexus, .codex, .claude, or .openclaw paths. Provenance text in old references should not be used as runtime instruction.