Individual skill

production-audit

Exhaustive production-readiness audit of any codebase or product. Runs diverse-angle discovery passes until two consecutive passes find nothing new, adversarially verifies every finding against the real code, and reports one flat severity-tagged list with file:line evidence. No summary, no hedging.

production-audit/SKILL.md

Read pinned source

Source commit 5acb1ed642a09766170a518a03766289ccce53b6

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: Yes
Skill scan complete: Yes
Observed behavior: Instructions only
Last checked: Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

Claude Code

Destination .claude/skills/production-audit

(
  set -euo pipefail
  destination='./.claude/skills/production-audit'
  if [ -e "$destination" ] || [ -L "$destination" ]; then printf '%s\n' 'Destination already exists; nothing overwritten.' >&2; exit 1; fi
  work=$(mktemp -d)
  trap 'rm -rf -- "$work"' EXIT
  git clone --filter=blob:none --no-checkout -- 'https://github.com/apoorvjain25/production-audit.git' "$work/repo"
  git -C "$work/repo" checkout --detach 5acb1ed642a09766170a518a03766289ccce53b6
  git -C "$work/repo" archive --format=tar '5acb1ed642a09766170a518a03766289ccce53b6:production-audit' > "$work/skill.tar"
  mkdir -p -- './.claude/skills'
  mkdir -- "$destination"
  tar -xf "$work/skill.tar" -C "$destination"
)

Codex

Destination .agents/skills/production-audit

(
  set -euo pipefail
  destination='./.agents/skills/production-audit'
  if [ -e "$destination" ] || [ -L "$destination" ]; then printf '%s\n' 'Destination already exists; nothing overwritten.' >&2; exit 1; fi
  work=$(mktemp -d)
  trap 'rm -rf -- "$work"' EXIT
  git clone --filter=blob:none --no-checkout -- 'https://github.com/apoorvjain25/production-audit.git' "$work/repo"
  git -C "$work/repo" checkout --detach 5acb1ed642a09766170a518a03766289ccce53b6
  git -C "$work/repo" archive --format=tar '5acb1ed642a09766170a518a03766289ccce53b6:production-audit' > "$work/skill.tar"
  mkdir -p -- './.agents/skills'
  mkdir -- "$destination"
  tar -xf "$work/skill.tar" -C "$destination"
)

Cursor

Destination .cursor/skills/production-audit

(
  set -euo pipefail
  destination='./.cursor/skills/production-audit'
  if [ -e "$destination" ] || [ -L "$destination" ]; then printf '%s\n' 'Destination already exists; nothing overwritten.' >&2; exit 1; fi
  work=$(mktemp -d)
  trap 'rm -rf -- "$work"' EXIT
  git clone --filter=blob:none --no-checkout -- 'https://github.com/apoorvjain25/production-audit.git' "$work/repo"
  git -C "$work/repo" checkout --detach 5acb1ed642a09766170a518a03766289ccce53b6
  git -C "$work/repo" archive --format=tar '5acb1ed642a09766170a518a03766289ccce53b6:production-audit' > "$work/skill.tar"
  mkdir -p -- './.cursor/skills'
  mkdir -- "$destination"
  tar -xf "$work/skill.tar" -C "$destination"
)

Gemini CLI

Destination .gemini/skills/production-audit

(
  set -euo pipefail
  destination='./.gemini/skills/production-audit'
  if [ -e "$destination" ] || [ -L "$destination" ]; then printf '%s\n' 'Destination already exists; nothing overwritten.' >&2; exit 1; fi
  work=$(mktemp -d)
  trap 'rm -rf -- "$work"' EXIT
  git clone --filter=blob:none --no-checkout -- 'https://github.com/apoorvjain25/production-audit.git' "$work/repo"
  git -C "$work/repo" checkout --detach 5acb1ed642a09766170a518a03766289ccce53b6
  git -C "$work/repo" archive --format=tar '5acb1ed642a09766170a518a03766289ccce53b6:production-audit' > "$work/skill.tar"
  mkdir -p -- './.gemini/skills'
  mkdir -- "$destination"
  tar -xf "$work/skill.tar" -C "$destination"
)

GitHub Copilot

Destination .github/skills/production-audit

(
  set -euo pipefail
  destination='./.github/skills/production-audit'
  if [ -e "$destination" ] || [ -L "$destination" ]; then printf '%s\n' 'Destination already exists; nothing overwritten.' >&2; exit 1; fi
  work=$(mktemp -d)
  trap 'rm -rf -- "$work"' EXIT
  git clone --filter=blob:none --no-checkout -- 'https://github.com/apoorvjain25/production-audit.git' "$work/repo"
  git -C "$work/repo" checkout --detach 5acb1ed642a09766170a518a03766289ccce53b6
  git -C "$work/repo" archive --format=tar '5acb1ed642a09766170a518a03766289ccce53b6:production-audit' > "$work/skill.tar"
  mkdir -p -- './.github/skills'
  mkdir -- "$destination"
  tar -xf "$work/skill.tar" -C "$destination"
)

OpenCode

Destination .opencode/skills/production-audit

(
  set -euo pipefail
  destination='./.opencode/skills/production-audit'
  if [ -e "$destination" ] || [ -L "$destination" ]; then printf '%s\n' 'Destination already exists; nothing overwritten.' >&2; exit 1; fi
  work=$(mktemp -d)
  trap 'rm -rf -- "$work"' EXIT
  git clone --filter=blob:none --no-checkout -- 'https://github.com/apoorvjain25/production-audit.git' "$work/repo"
  git -C "$work/repo" checkout --detach 5acb1ed642a09766170a518a03766289ccce53b6
  git -C "$work/repo" archive --format=tar '5acb1ed642a09766170a518a03766289ccce53b6:production-audit' > "$work/skill.tar"
  mkdir -p -- './.opencode/skills'
  mkdir -- "$destination"
  tar -xf "$work/skill.tar" -C "$destination"
)

Repository context

Repository stars (not skill ratings): 18
Repository last updated: Jun 25, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

ai-agents Repository topic
anthropic Repository topic
claude Repository topic
claude-code Repository topic
claude-skills Repository topic
code-audit Repository topic
code-review Repository topic
developer-tools Repository topic
llm Repository topic
loop-engineering Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 11,365 bytes
references/audit-angles.mddoc · 15,636 bytes
references/finding-taxonomy.mddoc · 8,946 bytes

Read excerpt


# Production Audit

You are running a complete production-readiness audit. The goal is not "a list of issues". It is **everything that is wrong**, proven against the real code, reported in a format a team can fix row by row.

Do NOT stop for confirmation between phases. Do NOT summarize. The flat list IS the report.

This is a defensive engagement: the codebase under audit is one the user owns or is authorized to test and modify. Find defects, prove them, and (in fix mode) remediate them. Do not produce working exploits, attack live systems, or probe anything outside this codebase.

## Core principles

1. **Trust what the code does, not what it's called.** A function named `validatePermissions` proves nothing. Open it. Trace the actual path: UI → API → data layer → response → render.
2. **A claim without code is a finding.** If the README, landing page, docs, or marketing copy promises something the code doesn't do, that's a HIGH-severity finding, not an observation.
3. **One pass is never enough.** A single audit pass finds what that pass's framing makes visible. Converge instead: keep auditing from *different angles* until two consecutive passes surface zero new findings.
4. **Every finding gets verified before it gets reported.** Before a row makes the list, verify it against the real code: confirm the location, then check whether a guard, an enforcement elsewhere, or unreachability actually clears it. Verify, do not argue it away; the goal is an honest verdict, not a shorter list. Plausible-but-wrong findings destroy trust in the whole list; so do real findings dismissed too quickly.