audit-integrity
Helps your agent ensure quality and evidence verification in security audits. It prevents valid findings from being ignored and evaluates reports.
What it does
This tool helps ensure security audits are done correctly by verifying concrete evidence and preventing findings from being ignored. It ensures security reports meet high-quality standards.
When to use it
- ✓When performing a security analysis on code.
- ✓When reviewing a security report to ensure it's complete and accurate.
- ✓When you need to be sure all found vulnerabilities have been properly investigated.
Example of what to ask your AI
“Verify that this security report meets all quality criteria and that all findings have clear evidence in the code.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool uses a set of rules and checks to ensure each step of the security audit is followed. It asks for confirmation of evidence, prevents excuses for failures, and ensures the final output is reliable.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add github/awesome-copilot --skill audit-integrityOr download just the file:
curl -L https://raw.githubusercontent.com/github/awesome-copilot/main/skills/audit-integrity/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Audit Integrity Skill
Enforce output quality, intellectual honesty, and continuous improvement across security audits and code reviews.
When to Use
- Perform security analyses, threat models, code reviews, or quality audits.
- Validate that every finding has verified code evidence and taint flow.
- Prevent the suppression or rationalization of security findings.
- Evaluate draft reports against the quality gate threshold (score ≥ 8/10).
- Record lessons learned and security memories after you complete a scan.
Components
This skill provides 7 modular capabilities in the references/ directory. Load each file when you reach its execution phase:
| Component | Reference File | Purpose |
|---|---|---|
| Clarification Protocol | references/clarification-protocol.md | Ask a maximum of 2 targeted questions when scope is not clear |
| Anti-Rationalization Guard | references/anti-rationalization-guard.md | Prohibited rationalizations and mandatory responses for findings |
| Self-Critique Loop | references/self-critique-loop.md | Mandatory second pass to verify evidence and coverage |
| Retry Protocol | references/retry-protocol.md | Tool failure and empty search handling: retry once, then document |
| Non-Negotiable Behaviors | references/non-negotiable-behaviors.md | Mandatory rules: do not fabricate, cite evidence, report gaps |
| Self-Reflection Quality Gate | references/self-reflection-quality-gate.md | Scoring rubric (1–10 scale) with a minimum threshold of 8 |
| Self-Learning System | references/self-learning-system.md | Templates and rules for lessons and security memories |
Execution Flow
Load reference files as you reach each phase:
- Before analysis: If scope or policy is not clear, read references/clarification-protocol.md. Ask a maximum of 2 targeted questions.
- During analysis: Follow references/non-negotiable-behaviors.md. At each triage decision, consult references/anti-rationalization-guard.md.
- On tool or search failure: Follow references/retry-protocol.md. Do not assume code is secure without verification.
- After initial analysis: Complete a second pass with the checklist in references/self-critique-loop.md. Verify taint traces and manifest coverage.
- Before delivery: Score the draft report using references/self-reflection-quality-gate.md. All categories must score ≥ 8.
- Final delivery: Record lessons and memories using references/self-learning-system.md.
FAQ
What does 'verify code locations and taint traces' mean?
It means ensuring the security flaw found is actually in the code and understanding how it can be exploited.
What is a 'quality threshold'?
It's a minimum score (in this case, 8 out of 10) that a security report must achieve to be considered good enough.
Why is it important not to 'suppress' security findings?
Suppressing findings means ignoring or hiding security flaws. This is dangerous because it leaves the system vulnerable.
Details
Original description by the author
Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) bef
repo: github/awesome-copilot
Popularity
- GitHub stars
- 40k
- Ranking position
- #5011
- License
- MIT
- Updated
- 10/15/2026
Comments
- …
More skills from this repository
acquire-codebase-knowledge
Helps your agent understand and document an existing code project. It's useful for onboarding new people or getting an overview of the architecture.
github/awesome-copilot
acreadiness-assess
Enables your agent to assess a project's readiness for AI and generate a report. It's useful for understanding how well a project is prepared to use AI tools.
github/awesome-copilot
acreadiness-generate-instructions
Helps your agent create instructions for AI tools based on an assessment. It's useful for improving how AI interacts with code and closing identified gaps.
github/awesome-copilot
acreadiness-policy
Enables your agent to help define or apply policies for AI project assessment. It's useful for standardizing how projects are evaluated and ensuring compliance.
github/awesome-copilot
Similar skills
django-security
Helps your agent implement security practices in Django applications. It focuses on authentication, authorization, and prevention against common attacks, ensuring more secure code.
affaan-m/ECC
laravel-security
Helps your agent secure Laravel applications against threats. Implements security practices for authentication, authorization, and common attack prevention.
affaan-m/ECC
module-regression
Helps your agent manage changes in large projects. Ensures code changes in one part don't break other parts.
affaan-m/ECC