# Audit Pro

> Portable Audit Pro workflow for Codex. Use for '/audit-pro', '/audit', 'audit this', 'review this code', 'check this procedure', or an NPLF quality gate across code, procedures, skills, plugins, config, prompts, and architecture. Codex/GPT-5.6 Sol is final authority; optional cross-model discovery uses Claude and Ollama Cloud GLM 5.2. Do not use for ordinary explanation or direct bug fixing without an audit request.

- Skill: `cryptopafi/audit-pro` (Agent Skill, multi-file: 29 files)
- Install (CLI): `npx skillmds@latest add cryptopafi/audit-pro`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cryptopafi/audit-pro/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: cryptopafi (https://skillmd.com/u/cryptopafi)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/cryptopafi/audit-pro

---


<!-- GENERATED by forgebuild portable-skill v0.1.1; runtime=codex; core_sha256=76c7d2d256d12705c9753d8f42e3a54ab4421c432360dc8f3660eb7f7b36482c; target_sha256=22efdd223ceb9612d332a8a125c604f6e463f43ddb8ea997eccda34c5cd921b7; do not hand edit -->

# Audit Pro Skill

## Runtime Adapter (Codex/Hermes)

This is the portable Codex/Hermes install of Audit Pro. It must run from its own skill folder and must not depend on source-system project paths.

Audit Pro is Codex-native in this portable install: Codex CLI with `gpt-5.6-sol` at `max` reasoning is the final audit and verdict authority. Optional cross-model discovery uses Claude CLI and GLM 5.2 through Ollama Cloud. Gemini was retired on 2026-07-05 and must not be dispatched; `--gemini-only` is a deprecated compatibility alias for `--glm-only`.

## Skill Root

Resolve the skill root from the location of this `SKILL.md`.

Expected install path patterns:

- Codex agents skill: `$HOME/.agents/skills/audit-pro`
- Codex local skill: `$HOME/.codex/skills/audit-pro`
- Hermes main: `$HOME/.hermes/skills/audit-pro`
- Hermes pilot: `$HOME/hermes-pilot/data/skills/audit-pro`

For shell scripts, set or infer:

```bash
AUDIT_PRO_ROOT="${AUDIT_PRO_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"  # for scripts directly under scripts/
```

Scripts nested deeper than `scripts/` must resolve from their own depth or require `AUDIT_PRO_ROOT` to be exported by the caller.

The install paths above are documentation examples only. Active scripts must resolve runtime files from `AUDIT_PRO_ROOT` and configurable environment variables.

## Bundled Files

- `AUDIT-PRO.md` — core procedure and scoring rules.
- `commands/audit.md` — slash-command reference.
- `profiles/*.local.md` — portable profile defaults.
- `references/*.md` — calibration, DSE registry, anti-patterns, false positives.
- `scripts/*.sh` and `scripts/*.py` — optional local helpers.
- `output/` and `state/` — local runtime output.

## Execution

1. Read `AUDIT-PRO.md`.
2. Resolve the target file/directory from the user request.
3. Load `profiles/default.local.md` unless `--profile <name>` is provided.
4. Classify target type and audit tier.
5. Run the audit using the bundled procedure and references.
6. Write reports under `output/`.
7. Write loop/runtime state under `state/`.

If `output/` or `state/` is unavailable, return the report inline and state that persistence was skipped.

Optional external integrations are disabled by default. Cross-model mode requires Claude discovery, GLM 5.2 discovery, and Codex/GPT-5.6 Sol reconciliation. Use environment variables or explicit flags only:

- `AUDIT_PRO_STORE_URL` for a knowledge-store endpoint.
- `AUDIT_PRO_EXPORT_DIR` for external report export.
- `AUDIT_PRO_CODEX_MODEL` and `AUDIT_PRO_CODEX_REASONING_EFFORT` for the Codex authority route.
- `CLAUDE_BIN` for the Claude discovery lane.
- `GLM_MODEL`, `OLLAMA_CLOUD_BASE_URL`, and `GLM_MAX_TOKENS` for the GLM discovery lane.
- `OLLAMA_API_KEY` from the environment or macOS Keychain; `OLLAMA_ENV_FILE` is an explicit optional fallback. Never print the key.

## Smoke Checks

The smoke script validates structure, shell/Python syntax, sanitizer redaction behavior, SSH path-shape redaction, portable-mode dry run, and required runtime scaffold directories.

```bash
AUDIT_PRO_ROOT="${AUDIT_PRO_ROOT:-$HOME/.codex/skills/audit-pro}"
bash "$AUDIT_PRO_ROOT/scripts/audit-pro-smoke.sh"
bash -n "$AUDIT_PRO_ROOT/scripts/"*.sh
PYTHONPYCACHEPREFIX="${TMPDIR:-/tmp}/audit-pro-pycache" python3 -m py_compile "$AUDIT_PRO_ROOT/scripts/audit-discover.py"
bash "$AUDIT_PRO_ROOT/scripts/glm-audit-dispatch.sh" --preflight
```

## Boundary Rule

This skill is portable only if active execution paths do not contain hardcoded `.nexus`, `.codex`, `.claude`, or `.openclaw` paths. Provenance text in old references should not be used as runtime instruction.