How do I install the Red Handed Audit skill?

Run npx skillmds@latest add gabrielmoreira/red-handed-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Red Handed Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Red Handed Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Red Handed Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Red Handed Audit?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Red Handed Audit by gabrielmoreira — Agent Skill

Name: Red Handed Audit
Rating: 4.5 (4 reviews)
Author: gabrielmoreira

Red Handed Audit

Check whether the tests the agent said passed actually ran. Reads the Claude Code session transcript and git state locally, then reports each gap with a timestamp and the quoted line. No model calls, nothing leaves the machine.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Red-handed Audit

Audit the current session's claims against its own record. If the agent said the tests pass, this checks that a test run actually happened, that it did not fail, and that no expected value was quietly rewritten to match a bug.

When to Use This Skill

The agent reported passing tests and you want to confirm a run actually happened
A test suite got smaller and you want to know when and why
You are reviewing a finished session before trusting its summary

What This Skill Does

Runs npx --yes @jinhyuk9714/red-handed@latest audit in the project directory
The CLI reads the local Claude Code transcript and the git working tree
Nine deterministic checks compare what was said with what was done
Each finding comes with a timestamp and the quoted line it came from

No model is called. The same session gives the same verdict every time.

How to Use

Basic Usage

Audit this session. Did the tests I was told about actually run?

The skill runs:

npx --yes @jinhyuk9714/red-handed@latest audit

Useful variations:

npx --yes @jinhyuk9714/red-handed@latest audit --all      # every session for this project
npx --yes @jinhyuk9714/red-handed@latest stats            # counts across the whole machine
npx --yes @jinhyuk9714/red-handed@latest audit --lang ko  # report in Korean

Example

User: "Before I merge this, check whether the tests really ran."

Output:

CAUGHT  claim-vs-fail
  14:02:31  "All 33 tests pass."
  14:01:58  npx vitest run … exit 1, 2 failed
  The last run before the claim failed. Nothing ran after it.

A clean session prints nothing to accuse. That is the common case.

Tips

CAUGHT needs two things at once: the session shows it happening and the code still shows it now
SUSPICIOUS means the pattern is there but the motive is not established
Verification the tool cannot read counts as verification it did not see, so browser tests and custom scripts only ever reach SUSPICIOUS
Exit code 1 means findings at the CAUGHT tier. That is the tool working, not an error

---name: red-handed-auditdescription: Check whether the tests the agent said passed actually ran. Reads the Claude Code session transcript and git state locally, then reports each gap with a timestamp and the quoted line. No model calls, nothing leaves the machine.--- # Red-handed Audit Audit the current session's claims against its own record. If the agent said the tests pass, this checks that a test run actually happened, that it did not fail, and that no expected value was quietly rewritten to match a bug. ## When to Use This Skill - The agent reported passing tests and you want to confirm a run actually happened - A test suite got smaller and you want to know when and why - You are reviewing a finished session before trusting its summary ## What This Skill Does 1. Runs `npx --yes @jinhyuk9714/red-handed@latest audit` in the project directory 2. The CLI reads the local Claude Code transcript and the git working tree 3. Nine deterministic checks compare what was said with what was done 4. Each finding comes with a timestamp and the quoted line it came from No model is called. The same session gives the same verdict every time. ## How to Use ### Basic Usage ``` Audit this session. Did the tests I was told about actually run? ``` The skill runs: ```bash npx --yes @jinhyuk9714/red-handed@latest audit ``` Useful variations: ```bash npx --yes @jinhyuk9714/red-handed@latest audit --all # every session for this project npx --yes @jinhyuk9714/red-handed@latest stats # counts across the whole machine npx --yes @jinhyuk9714/red-handed@latest audit --lang ko # report in Korean ``` ## Example **User**: "Before I merge this, check whether the tests really ran." **Output**: ``` CAUGHT claim-vs-fail 14:02:31 "All 33 tests pass." 14:01:58 npx vitest run … exit 1, 2 failed The last run before the claim failed. Nothing ran after it. ``` A clean session prints nothing to accuse. That is the common case. ## Tips - `CAUGHT` needs two things at once: the session shows it happening and the code still shows it now - `SUSPICIOUS` means the pattern is there but the motive is not established - Verification the tool cannot read counts as verification it did not see, so browser tests and custom scripts only ever reach `SUSPICIOUS` - Exit code 1 means findings at the CAUGHT tier. That is the tool working, not an error

Frequently asked questions