Language- and framework-agnostic audit checklists for AI coding agents — security, correctness, and operability. Works with Claude Code, GitHub Copilot, Cursor, Codex CLI, OpenCode, and any agent that can read files.
This repository also configures its own agents. See what audit-skills tells them →
Skill Claude CodeCodex
Query-amplification (N+1) checklist. Use when code loads related data inside a loop over a collection, or when reviewing ORM-heavy read paths for performance.
Skill Claude CodeCodex
Numeric and money precision checklist. Use when code computes money, totals, taxes, or splits — float used for currency, ad hoc rounding, integer overflow, division remainders, or unit/currency mismatches.
Skill Claude CodeCodex
Observability checklist. Use when checking whether errors, slow paths, or new endpoints would be visible in production — logging, metrics, tracing, alerts.
Skill Claude CodeCodex
Output encoding and XSS checklist. Use when user-controlled data is rendered into HTML, JavaScript, CSS, URLs, headers, or emails.
Skill Claude CodeCodex
Parser/validator differential checklist. Use when reviewing validators, regexes, allowlists, URL or path parsing, content-type checks, or normalization — inputs a gate accepts but the downstream consumer interprets differently (unanchored regexes, startswith allowlists, two URL parsers, validate-then-reparse).
Skill Claude CodeCodex
Resource-exhaustion checklist. Use when reviewing endpoints for missing pagination, unbounded loops over input, missing size or rate limits, regex backtracking, or IN lists and bulk statements that can exceed database parameter limits.
Skill Claude CodeCodex
Database schema design checklist (indexes, foreign keys, constraints). Use when reviewing migrations, new tables or columns, slow queries, missing indexes, foreign-key and ON DELETE behavior, or integrity rules enforced only in app code.
Skill Claude CodeCodex
Secrets-handling checklist. Use when reviewing code or config touching API keys, credentials, or tokens — hardcoding, logging, committing, rotation.
Skill Claude CodeCodex
Server-side request forgery checklist (includes open redirects). Use when code makes network requests to URLs, hosts, or IPs derived from user input — webhooks, fetchers, URL previews, importers.
Skill Claude CodeCodex
Shared and concurrent state checklist. Use when reviewing code with shared mutable state, caching, counters, or check-then-act sequences (race conditions).
Skill Claude CodeCodex
Statelessness checklist for horizontally scaled apps. Use when reviewing services meant to run as multiple replicas — in-memory sessions or counters, module/static mutable state, local-disk uploads, process-local locks or schedulers, sticky-session assumptions, state lost on deploy.
Skill Claude CodeCodex
Multi-tenant isolation checklist. Use when reviewing queries, caches, or background jobs in a multi-tenant app for cross-tenant data leakage — tenant scoping, shared cache keys.
Skill Claude CodeCodex
Time, timezone, and clock-correctness checklist. Use when code stores or computes timestamps, durations, timeouts, or expiry — naive vs aware datetimes, server-local now(), wall-clock for elapsed time, DST and calendar math, cross-zone comparisons.
Skill Claude CodeCodex
Inbound token and webhook verification checklist. Use when code verifies JWTs, API keys, signed URLs, or webhook signatures — decode-without-verify, alg confusion, missing exp/aud/iss checks, kid/JWKS handling, HMAC over raw body, replay windows.
Skill Claude CodeCodex
Full security, correctness, and operability audit of code. Use when reviewing a diff, endpoint, or feature for vulnerabilities or bugs without a specific topic in mind — security review, audit, code review for safety, "check this for issues".
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: