# Audit Integrity > Enforce AppSec audit integrity for security analysis, code review, threat modeling, SAST, SCA, and quality scan agents. Use this skill when running a post-analysis quality gate, preventing rationalization, retrying failed evidence collection, running a second-pass self-critique, scoring output from 1-10 with a ≥8 threshold, or recording governed lessons or memories. - Skill: `paulasilvatech/audit-integrity-2` (Agent Skill, multi-file: 8 files) - Install (CLI): `npx skillmds@latest add paulasilvatech/audit-integrity-2` - Raw SKILL.md: https://api.skillmd.com/api/skills/paulasilvatech/audit-integrity-2/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: paulasilvatech (https://skillmd.com/u/paulasilvatech) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/paulasilvatech/audit-integrity-2 --- # Audit integrity Apply an evidence-first quality framework to AppSec analysis so every finding, omission, retry, self-critique, and lesson is explicit, cited, and intellectually honest before delivery. ## When to invoke - "Run the audit integrity gate on this security review." - "Self-critique this SAST or SCA analysis before delivery." - "Check that the threat model did not rationalize missing evidence." - "Apply the AppSec quality gate with ≥8 scoring." - "Record lessons from this false positive or methodology gap." ## Integrity components | Component | Reference file | Purpose | When to apply | | --- | --- | --- | --- | | Clarification Protocol | `references/clarification-protocol.md` | Ask ≤2 targeted questions before analysis when scope is ambiguous. | Before analysis if scope is unclear. | | Anti-Rationalization Guard | `references/anti-rationalization-guard.md` | Detect prohibited rationalizations and replace them with mandatory evidence-seeking responses. | During every decision point. | | Self-Critique Loop | `references/self-critique-loop.md` | Run a mandatory second-pass review after the initial analysis. | After initial findings are drafted. | | Retry Protocol | `references/retry-protocol.md` | Retry failed evidence collection once, then document residual gaps. | On tool failure, inaccessible files, or incomplete data. | | Non-Negotiable Behaviors | `references/non-negotiable-behaviors.md` | Non-negotiable and non-negotiable behaviors: never fabricate, always cite evidence, report gaps, and preserve uncertainty. | Throughout the audit. | | Self-Reflection Quality Gate | `references/self-reflection-quality-gate.md` | Score categories from 1-10 and require a ≥8 threshold per category. | Before delivery. | | Self-Learning System | `references/self-learning-system.md` | Govern Lesson and Memory creation for novel domain-specific findings, false positives, or methodology gaps. | After delivery or when durable learning is warranted. | ## Procedure 1. Before analysis, apply the Clarification Protocol if scope, target, or evidence source is ambiguous; ask no more than two targeted questions when interaction is possible. 2. During analysis, apply the Anti-Rationalization Guard and Non-Negotiable Behaviors to every claim and evidence gap. 3. After the first pass, execute the Self-Critique Loop as a second pass; customize the checklist for the agent's domain. 4. On any failed tool, missing file, or unavailable evidence, apply the Retry Protocol: retry once, then document the remaining gap. 5. Before delivery, run the Self-Reflection Quality Gate. All categories must score ≥8 or the agent must revise and rescore. 6. After delivery, create governed Lessons/Memories and lesson/memory records only for novel findings, false positives, or methodology gaps that meet the Self-Learning System rules. ## Agent-specific adaptation | Agent type | Add to Self-Critique Loop | Add to Self-Reflection Quality Gate | | --- | --- | --- | | SAST/SCA agents | Taint trace completeness, dependency manifest coverage, reachable sink validation. | Evidence depth, exploitability calibration, manifest coverage. | | SonarQube-style agents | Rating sanity check and A-E consistency with findings. | Rating consistency, remediation specificity, false-positive control. | | Threat modeling agents | STRIDE category completeness per trust boundary and data flow. | Boundary coverage, abuse-case realism, mitigation traceability. | | Code review agents | Trust boundary audit, data flow tracing, changed-line versus reachable-code distinction. | Changed-code relevance, regression risk, citation quality. | ## Criteria ### Evidence honesty - [ ] Every finding has concrete evidence: file/line, data flow, dependency record, policy, or tool output. - [ ] Gaps are reported as gaps, not converted into assumptions. - [ ] Tool failures follow the retry-once protocol before being documented. ### Output quality - [ ] Findings are severity-calibrated and do not exaggerate unsupported impact. - [ ] Self-critique changed the result or explicitly confirmed no changes with reasons. - [ ] Every self-reflection category scores ≥8 before delivery. ## Progressive disclosure and bundled resources - `references/clarification-protocol.md`: ambiguity handling and ≤2-question rule. - `references/anti-rationalization-guard.md`: anti-rationalization prohibited rationalization table and mandatory responses. - `references/self-critique-loop.md`: second-pass review template. - `references/retry-protocol.md`: retry once, then document failure handling. - `references/non-negotiable-behaviors.md`: hard integrity rules. - `references/self-reflection-quality-gate.md`: 1-10 scoring rubric with ≥8 threshold. - `references/self-learning-system.md`: Lesson/Memory templates and governance rules. ## Gotchas - **Do not let confidence replace evidence**: expert intuition can prioritize investigation, but it cannot be the evidence for a finding. - **Do not hide inaccessible scope**: document files, services, or tools that could not be examined. - **Do not create memories for routine facts**: use the self-learning governance rules and avoid storing sensitive information. ## Output template ```markdown ### Audit integrity gate **Status:** pass | revise required | blocked **Scope reviewed:** `` **Self-reflection minimum score:** `/10` | Gate | Result | Evidence | | --- | --- | --- | | Clarification Protocol | pass/not needed/fail | `` | | Anti-Rationalization Guard | pass/fail | `` | | Self-Critique Loop | pass/fail | `` | | Retry Protocol | pass/not needed/fail | `` | | Non-Negotiable Behaviors | pass/fail | `` | | Self-Reflection Quality Gate | pass/fail | `` | | Self-Learning System | pass/not needed/fail | `` | **Required revisions** - `` ``` ## Quality gate - [ ] All 7 components were applied unless a component was explicitly out of scope. - [ ] Ambiguous scope used the Clarification Protocol before analysis. - [ ] The Anti-Rationalization Guard was applied to unsupported assumptions. - [ ] A second-pass Self-Critique Loop was completed. - [ ] Tool failures were retried once and documented if still unresolved. - [ ] Non-Negotiable Behaviors are satisfied: no fabrication, cited evidence, and reported gaps. - [ ] Every Self-Reflection Quality Gate category scored ≥8. - [ ] Lesson/Memory and Lessons/Memories creation followed governance and excluded sensitive information.