How to use the Audit Integrity Checks agent skill

What the audit-integrity skill makes the agent do

An agent skill is a folder containing a SKILL.md file and optional reference files. When a skill is installed, the agent reads it and follows its instructions for matching tasks. This skill asks the agent to check every finding against actual code locations and data-flow (taint) traces, avoid dismissing valid findings, and document rationale for any severity decision.

The skill also defines an execution flow: ask a limited number of clarifying questions, retry failed tool calls once before recording the gap, run a second self-critique pass, score the draft report against a 1-10 rubric with a minimum of 8, and record lessons learned after the scan.

• Verify each finding against code locations and taint traces.
• Ask at most two clarifying questions, then state assumptions and proceed.
• Retry a failed tool call once, then document the gap.
• Run a second self-critique pass over evidence and coverage.
• Score the draft report; all categories must score at least 8.
• Record lessons and security memories after a scan.

How do you install the audit-integrity skill?

Download the ZIP for skills/audit-integrity from the page. Unzip it so the folder named audit-integrity, containing SKILL.md and the references/ folder, sits in one of these locations.

For a personal install across projects, place it in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. Alternatively, in the Claude apps you can upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/audit-integrity/
• Project: .claude/skills/audit-integrity/ inside your repository
• Claude apps: Settings → Capabilities → Skills, then upload

How do you trigger the skill with natural requests?

You do not need a special command. Mention a security task and say you want the work checked for evidence and quality. The skill's description lists the triggers: SAST, SCA, threat modelling, security code reviews, verifying code locations and taint traces, preventing suppression of valid findings, and evaluating reports against the score of 8/10 before delivery.

Name the scope when you can. The clarification protocol means the agent may ask up to two questions if the target module or language is unclear.

• "Run a security review of the payments module and verify each finding's taint trace."
• "Do a SAST pass on this repo and score the report against the quality gate before you deliver it."
• "Threat model the upload service. Don't drop any finding without evidence."

What should you expect in the output?

Reports produced with the skill should cite specific file paths, line numbers, CVE IDs, components or trust boundaries for each finding, state the reasoning behind severity verdicts, and list coverage gaps explicitly rather than omitting phases. The agent is also asked not to modify source files unless you request changes.

Expect a self-critique pass and a quality score in the draft. The score is produced by the same agent, so treat it as a checklist result, not an independent check.

• Per-finding file, line or component citations
• Explicit rationale for severity and compliance verdicts
• A list of coverage gaps and failed tool calls
• No source-file edits unless you asked for them

What does the skill need and what are its safety notes?

The source lists no required dependencies. The skill does not run scripts and does not use the network, according to its listing. It is a set of Markdown instructions, so it adds guidance to the agent rather than tools that act on your system.

The skill does not bundle scanners or security tools. You still need an agent environment that can read your code, and any scanners you use must come from elsewhere.

• Requires: nothing listed
• Runs scripts: no
• Uses network: no
• Bundles no scanners; the agent's own tool access determines what it can inspect

What are good tips for using it well?

Use the skill for real audits, not one-off code questions, where the full workflow is unnecessary overhead. Treat the quality score as a self-assessment. Spot-check a few citations yourself, especially the taint traces, before acting on a report.

• Reserve it for full security audits and multi-finding reviews.
• Spot-check citations and taint traces against the code.
• Review the recorded gaps; they show what the agent could not verify.
• Use it alongside your own scanners and human review for high-stakes decisions.