audit-docs

A documentation audit that compares the project's documents, roadmap, code, fix list, and issues to find inconsistencies and broken links.

In plain words
What is it for?
Use it before releases or milestones, after several changes are merged, or whenever you suspect the documentation has fallen out of sync.
Why use it?
It shows where documentation no longer matches the product or planned work. It reports drift without rewriting documents unless explicitly allowed.

Skill for Claude CodeCodex

Part of the agentic-workflow plugin — 35 skills shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/gtrabanco/agentic-workflow/audit-docs
Any agent
npx skills add gtrabanco/agentic-workflow --skill audit-docs
Clone the repo
git clone --depth 1 https://github.com/gtrabanco/agentic-workflow

Made for: Claude Code, Codex.

Or install agentic-workflow, the plugin that ships this one along with the rest of its 35 skills.

Per session 188 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,170 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00188 $0.02170
Opus 5 $0.00094 $0.01085
Sonnet 5 $0.00038 $0.00434
Haiku 4.5 $0.00019 $0.00217

Measured 3d ago against content hash 428b39d4f0d2, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

audit-docs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/pi-agentic-workflow/skills/audit-docs/SKILL.md · 172 lines

How it starts

The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Audit Docs

A read-first audit answering "do the docs still match reality?" Produces a findings report; it does not silently rewrite docs.

Turn contract — verify before ending the turn

✓ The AUDIT DOCS fixed-format report was printed, ending in `Decision: PASS | FAIL`
✓ No doc was rewritten without explicit --fix / user go-ahead
✓ The closing `→ Next:` block is printed as the ABSOLUTE last output

About to end the turn with any box unchecked? The turn is NOT done — complete the missing box first (weak models drop end-of-document duties; this list is first on purpose).

When to use

  • Before a release or milestone, after merging several features/fixes, or whenever the doc set might have drifted from the code and issues.

Step 0 — Discover the project (always first)

Per the agent guide's Workflow conventions + documentation map, then read what THIS skill needs: the roadmap, the fix index + template, and the feature folder layout — the map tells you which links and invariants to check.

Checks

Run these and collect findings (cite paths/lines/issue numbers each):

  1. Roadmap ↔ feature folders. Every docs/features/<NN>-<slug>/ is in the roadmap, and every roadmap entry has a folder (or is explicitly "scheduled").
  2. Feature dependencies. SPEC Depends on / Branch fields are valid; no dependency cycles; ordering is consistent with the roadmap.
  3. Fix index hygiene. Every entry maps to an open issue and an unmerged branch; flag entries whose issue is closed or whose PR merged (should have been removed). Flag open fix branches missing from the index.
  4. Documentation-map links resolve. Every file the map references exists; flag "scheduled, not yet authored" items so they aren't mistaken for drift.
  5. Broken intra-doc links. Relative links/anchors point at real files/sections.
  6. Issue references. Acceptance/known-issues lines referencing #N aren't pointing at long-closed issues without note.
  7. Language & naming conventions. Artifacts in the project's docs language (this repo: English); file/dir naming matches conventions (e.g. kebab-case TS files, PascalCase components).
  8. Invariant tags. If the project uses invariant/decision IDs (e.g. INV-/D-/KI-), spot-check that referenced IDs exist where claimed.
  9. PR-link integrity on done rows. Every roadmap row (and fix-index entry) with status done carries a linked PR reference — done · [#<pr>](<pr-url>). For each bare done, find its PR in the forge (gh pr list --state all --head feat/<NN>-<slug> or by title) and propose the row update; a done with no PR found at all is HIGH severity (the unit may never have been closed out).

Read the full file on GitHub · 172 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 172 lines · 188 tokens per session scan A 428b39d4f0d2

Subscribe to this mod's changes

audit-docs is a skill published in the GitHub repository gtrabanco/agentic-workflow (20 stars, last pushed 3d ago), licensed MIT. It adds 188 tokens to every session and 2,170 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

think-like-me

Personal engineering rules and reasoning patterns the user has curated over time. Consult BEFORE writing, modifying, debugging, or designing any technical feature — rules often cover domain-specific gotchas (e.g., mobile audio timers need background mode) that generic answers miss. Also triggers on /learn-this, "learn…

kakha13/think-like-me · 88 tokens

offensive-crypto-attacks

Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block cut-and-paste and…

SnailSploit/Claude-Red · 261 tokens

offensive-mobile

Mobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component…

SnailSploit/Claude-Red · 185 tokens

offensive-parameter-pollution

HTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.

SnailSploit/Claude-Red · 0 tokens

sandbox-next

Use when building or changing Cloudflare Sandbox apps on @cloudflare/sandbox@next (Sandbox SDK 1.0 preview)—code execution, AI runners, interpreters, CI-like jobs, terminals, files, mounts, tunnels, preview URLs, lifecycle, or errors. Not for the default stable package (use sandbox-stable) or for porting stable to…

cloudflare/skills · 86 tokens

offensive-anti-forensics

Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE…

SnailSploit/Claude-Red · 243 tokens