Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Audit · tobihagemann | DecimalAI

code reviewby tobihagemann

Audit

tobihagemann/audit

Source tobihagemann/turbo ↗License MIT

Project-wide health audit pipeline that fans out to all analysis skills in parallel, evaluates findings, and produces a unified report at .turbo/audit.md.

SkillScore48Maintained

Automatic

QA & Test Engineering pack

Last verified 8/27/2026

What it changes

Passed 7 of 15 test cases with the skill, and 6 of 15 without it.

Without skill40%

With skill48%

Checks it passed that the model alone missed

Uses update_plan at the start to track workflow phases.
States the explicit total agent count of 23 prior to dispatching the batch.
Executes empirical checks inside an isolated git worktree created under TMPDIR.

and 2 more in the full report

5 fixed7 passed either way10 still failing3 broke

Pass-rate lift: +8 pp
Tokens: +52%
Agent turns: 0%
Response time: -59%

Model gemini-3.6-flashMeasured 8/27/2026v612 of 25 cases passed with skill · 15 comparable

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/tobihagemann-audit/SKILL.md https://app.decimal.ai/s/tobihagemann-audit/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add tobihagemann-audit, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/tobihagemann-audit/ and pins it in .decimal/skills.lock

decimalai skills add tobihagemann-audit

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/tobihagemann-audit/SKILL.md https://app.decimal.ai/s/tobihagemann-audit/SKILL.md

Raw file: /s/tobihagemann-audit/SKILL.md ↗ · machine-readable summary at /s/tobihagemann-audit.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 5

Prompt

In the Security category findings, there are 2 P1 vulnerabilities and 0 P0 critical flaws. Should this category be marked as 'Fail' on the summary dashboard?

What was checked, without and with the skill
Checked	Without skill	With skill
Assigns a health rating of Warn for categories containing P1 findings without P0 findings.	Missed	Passed

case-16 · gemini-3.6-flash · 8/27/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md166 linessingle file

Audit

Project-wide health audit. Fans out to all analysis skills, evaluates findings, and writes .turbo/audit.md and .turbo/audit.html. Analysis-only — does not apply fixes.

Task Tracking

At the start, use update_plan to track each phase, restating any remaining steps of a parent workflow alongside them:

Scope and partition
Threat model
Run analysis skills
Run $evaluate-findings skill
Generate markdown report
Generate HTML report

Step 1: Scope and Partition

If $ARGUMENTS specifies paths, use those directly (skip the question).

Otherwise, use request_user_input to confirm scope:

All source files — audit everything
Specific paths — user provides directories or file patterns
Critical paths — heuristically identify high-risk areas (entry points, auth, data handling, payment processing)

Once scope is determined:

Glob for source files in the selected scope. Exclude generated and vendored directories (node_modules/, dist/, build/, vendor/, __pycache__/, .build/, DerivedData/, target/, .tox/, and others appropriate to the project).
Partition files by top-level source directory. Cap at 10 partitions. If more than 10 top-level directories exist, group related directories or use request_user_input to narrow scope. If a single directory contains 50+ files, sub-partition it by its immediate subdirectories.

Step 2: Threat Model

Check whether .turbo/threat-model.md exists. When it exists, collect each surface's cited paths from Entry points and sinks and Hot files, ignoring any :line suffix. Treat the model as superseded when a surface has no cited path that still resolves. When it exists and is not superseded, continue to Step 3.

If missing or superseded, use request_user_input to ask whether to create one before proceeding. The security review benefits from threat model context, but creating one adds time.

Yes — launch a Codex sub-agent call (inherited model defaults) whose prompt instructs it to invoke the $create-threat-model skill by reading and following the installed skill instructions. Wait for completion before continuing.
No — continue without a threat model.

Step 3: Launch All Analysis Agents

Track record

Benchmark

7 / 15

test cases passed, vs 6 / 15 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 8/26/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

tobihagemann / turbo

claude/skills/audit/SKILL.md

View on GitHub ↗

License MITImported 8/26/2026Version v6

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

Audit

Task Tracking

Step 1: Scope and Partition

Step 2: Threat Model

Step 3: Launch All Analysis Agents

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills