# Audit Repository

> Audits a repository for quality, alignment, risk, and strengths using observable evidence. Use when a project needs an impartial assessment of its current state and actionable findings.

- Skill: `egohygiene/audit-repository` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add egohygiene/audit-repository`
- Raw SKILL.md: https://api.skillmd.com/api/skills/egohygiene/audit-repository/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: egohygiene (https://skillmd.com/u/egohygiene)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/egohygiene/audit-repository

---


# Audit Repository

<!-- aether-continuity-disposition: read-only -->

## Repository continuity composition

For repository-scoped work, compose `maintain-repository-continuity` in
**Resume** mode before selecting work. This skill is continuity read-only: do
not create, refresh, or otherwise mutate `CONTINUITY.md` unless a separate
authorized repository-changing workflow takes ownership of that handoff.

- **Contribute:** Audit scope, observed findings, confidence, evidence gaps, and executed checks
- **Never claim:** Permission to modify CONTINUITY.md, apply fixes, or convert recommendations into completed work

## Purpose

Execute the reusable procedure governed by `auditor`.

Primary question:

> What does observable repository evidence show about quality, alignment, risk, and strengths?

## Required Inputs

Resolve:

- governing specification and version
- current source or repository state
- scope and constraints
- upstream architecture or evidence
- output location
- validation expectations
- unresolved decisions

Missing evidence must remain visible.

## Workflow

1. resolve request, defaults, scope, and read-only constraints
2. inspect repository context in the required order
3. inspect historical audits
4. gather evidence within scope
5. classify findings and positive observations
6. assign severity, confidence, status, effort, and impact
7. record uncertainty and uninspected areas
8. propose bounded validation and candidate issues
9. write and validate the immutable report

## Output Contract

Primary output:

    audits/{audit-name}-{utc-timestamp}.md

Also report assumptions, evidence gaps, validation status, unresolved
questions, and downstream actions requiring separate authorization.

## Constraints

- Follow the governing specification.
- Preserve provenance and uncertainty.
- Do not invent authority, evidence, or current behavior.
- Do not silently expand scope.
- Do not claim completion when required validation is missing.
- Keep proposed downstream work separate from authorized execution.

## Completion Criteria

- [ ] Governing specification is resolved.
- [ ] Scope and constraints are explicit.
- [ ] Required evidence was inspected.
- [ ] The primary output was created.
- [ ] Validation was executed or its absence documented.
- [ ] Open questions and authorization needs are visible.

## Staged Variant

A staged candidate at `.staging/skills/repository-audit/` covers similar
ground under the name `repository-audit`. The canonical skill is named
`audit-repository` and is governed by the `auditor` specification.

Issue 016 should compare the two and extract any unique findings workflow,
output format, or severity taxonomy from the staged copy before retiring it.
Do not copy the staged file wholesale into canonical source.