Best for
- Every security analysis, code review, threat model, or quality scan agent run
- Applied automatically as a post-analysis quality gate
- Applicable to any agent performing SAST, SCA, threat modeling, or code quality analysis
Source profileQuality 77/100
github/awesome-copilot/skills/audit-integrity/SKILL.md
audit-integrity
Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.
- Source repository stars
- 37,126
- Declared platforms
- 0
- Static risk flags
- 0
- Last source update
- 2026-07-28
- Source checked
- 2026-07-28
Decision brief
What it does—and where it fits
Enforces output quality, intellectual honesty, and continuous improvement across all AppSec agents.
Not for
- Tasks that require unconfirmed production actions or broad system permissions.
- Environments where the pinned source and install steps cannot be inspected.
Compatibility matrix
Platform support, with evidence labels
| Platform | Status | Evidence | What to check |
|---|---|---|---|
| Codex | Not declared | No explicit evidence | Portability before use |
| Claude Code | Not declared | No explicit evidence | Portability before use |
| Cursor | Not declared | No explicit evidence | Portability before use |
| Gemini CLI | Not declared | No explicit evidence | Portability before use |
Installation
Inspect first. Install second.
The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.
Source-detected install commandSource
npx skills add https://github.com/github/awesome-copilot --skill "skills/audit-integrity"Safe inspection promptEditorial
Inspect the Agent Skill "audit-integrity" from https://github.com/github/awesome-copilot/blob/9933dcad5be5caeb288cebcd370eeeb2fc2f1685/skills/audit-integrity/SKILL.md at commit 9933dcad5be5caeb288cebcd370eeeb2fc2f1685. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.
Workflow
What the source asks the agent to do
- 01
When to Use
Every security analysis, code review, threat model, or quality scan agent run
Every security analysis, code review, threat model, or quality scan agent runApplied automatically as a post-analysis quality gateApplicable to any agent performing SAST, SCA, threat modeling, or code quality analysis - 02
Components
This skill provides 7 reusable capabilities. Agents apply all 7 unless their scope excludes a specific component.
This skill provides 7 reusable capabilities. Agents apply all 7 unless their scope excludes a specific component. - 03
Execution Flow
1. Before analysis: Apply Clarification Protocol if scope is ambiguous 2. During analysis: Apply Anti-Rationalization Guard at every decision point 3. After initial pass: Execute Self-Critique Loop (mandatory second pass) 4. On tool failure: Apply Retry Protocol 5. Before delive…
Before analysis: Apply Clarification Protocol if scope is ambiguousDuring analysis: Apply Anti-Rationalization Guard at every decision pointAfter initial pass: Execute Self-Critique Loop (mandatory second pass) - 04
Agent-Specific Adaptation
Each agent customizes the Self-Critique Loop checklist and Self-Reflection Quality Gate categories to match its domain. The reference files provide the base templates; agents extend them with domain-specific items.
SAST/SCA agents: Add taint trace completeness and manifest coverage checksSonarQube-style agents: Add rating sanity check (A–E consistency with findings)Threat modeling agents: Add STRIDE category completeness per trust boundary
Permission review
Static risk signals and limitations
No configured static risk pattern was detected
This is not proof of safety. Runtime behavior, indirect dependencies, and hidden external systems are outside the static scan.
Evidence record
Why each signal appears
EvidenceSourceComputedTestedEditorial
| Signal | Value | Evidence type | Meaning |
|---|---|---|---|
| Quality score | 77/100 | Computed | Documentation, specificity, maintenance, and trust rules |
| Repository stars | 37,126 | Source | Repository attention, not individual Skill quality |
| Compatibility | 0 platforms | Source | Declared in the catalog source record |
| Usage guide | automated source guide | Editorial | Generated or reviewed according to the visible evidence level |
Pinned source
Provenance and original SKILL.md
- Repository
- github/awesome-copilot
- Skill path
- skills/audit-integrity/SKILL.md
- Commit
- 9933dcad5be5caeb288cebcd370eeeb2fc2f1685
- License
- MIT
- Collected
- 2026-07-28
- Default branch
- main
View the original SKILL.md
Audit Integrity Skill
Enforces output quality, intellectual honesty, and continuous improvement across all AppSec agents.
When to Use
- Every security analysis, code review, threat model, or quality scan agent run
- Applied automatically as a post-analysis quality gate
- Applicable to any agent performing SAST, SCA, threat modeling, or code quality analysis
Components
This skill provides 7 reusable capabilities. Agents apply all 7 unless their scope excludes a specific component.
| Component | Reference File | Purpose |
|---|---|---|
| Clarification Protocol | clarification-protocol.md | Ask ≤2 targeted questions before analysis when scope is ambiguous |
| Anti-Rationalization Guard | anti-rationalization-guard.md | Table of prohibited rationalizations with mandatory responses |
| Self-Critique Loop | self-critique-loop.md | Mandatory second-pass review after initial analysis |
| Retry Protocol | retry-protocol.md | Tool failure handling — retry once, then document |
| Non-Negotiable Behaviors | non-negotiable-behaviors.md | Hard rules: never fabricate, always cite evidence, report gaps |
| Self-Reflection Quality Gate | self-reflection-quality-gate.md | 1–10 scoring rubric with ≥8 threshold per category |
| Self-Learning System | self-learning-system.md | Lesson/Memory templates and governance rules |
Execution Flow
- Before analysis: Apply Clarification Protocol if scope is ambiguous
- During analysis: Apply Anti-Rationalization Guard at every decision point
- After initial pass: Execute Self-Critique Loop (mandatory second pass)
- On tool failure: Apply Retry Protocol
- Before delivery: Run Self-Reflection Quality Gate (all categories must score ≥8)
- After delivery: Create Lessons/Memories for novel findings, false positives, or methodology gaps (see Self-Learning System)
Agent-Specific Adaptation
Each agent customizes the Self-Critique Loop checklist and Self-Reflection Quality Gate categories to match its domain. The reference files provide the base templates; agents extend them with domain-specific items.
Example extensions per agent type
- SAST/SCA agents: Add taint trace completeness and manifest coverage checks
- SonarQube-style agents: Add rating sanity check (A–E consistency with findings)
- Threat modeling agents: Add STRIDE category completeness per trust boundary
- Code review agents: Add trust boundary audit with data flow tracing
Alternatives
Compare before choosing
Computed 10042,015
coreyhaines31/marketingskills
ab-testing
When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "should I test this," "which version is better," "test two versions," "statistical significance," "how long should I run this test," "growth experiments," "experiment velocity," "experiment backlog," "ICE score," "experimentation program
Computed 10042,015
coreyhaines31/marketingskills
churn-prevention
When the user wants to reduce churn, build cancellation flows, set up save offers, recover failed payments, or implement retention strategies. Also use when the user mentions 'churn,' 'cancel flow,' 'offboarding,' 'save offer,' 'dunning,' 'failed payment recovery,' 'win-back,' 'retention,' 'exit survey,' 'pause subscription,' 'involuntary churn,' 'people keep canceling,' 'churn rate is too high,' 'how do I keep users,' or 'customers are leaving.' Use this whenever someone is losing subscribers o
Computed 997
event4u-app/agent-config
design-review
Use when the user says "review the design", "check the UI", or wants a comprehensive UI/UX review. Uses a 7-phase methodology covering interaction, responsiveness, accessibility, and more.
Computed 9831,966
K-Dense-AI/scientific-agent-skills
dask
Distributed computing for larger-than-RAM pandas/NumPy workflows. Use when you need to scale existing pandas/NumPy code beyond memory or across clusters. Best for parallel file processing, distributed ML, integration with existing pandas code. For out-of-core analytics on single machine use vaex; for in-memory speed use polars.