agentsclimarketplace

Project audit

Skill bglglzd/agent-workflows/plugins/agent-workflows/skills/project-audit

Portable Markdown workflows for AI coding agents — session handoffs, project audits, and product discovery.

Install
npx -y skills add bglglzd/agent-workflows --skill project-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 24 days oldThe repository was created 24 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Perform a deep, evidence-based, read-only audit of a software project. Use when Codex needs to map architecture, build and deployment paths, server posture, security risks, unfinished work, and prioritized remediation before proposing or making changes.

SKILL.md

2.3 KB, 406 tokens by cl100k_base, as published. Nobody here has run it

Project Audit

Audit the project before changing it. Produce conclusions that a maintainer can verify from evidence.

Workflow

  1. Inventory tracked files and relevant untracked configuration. Identify stack, entry points, package manifests, tests, docs, scripts, CI/CD, containers, infrastructure, environment templates, and git state.
  2. Map the system: application and data flow, trust boundaries, auth and permissions, persistence, background jobs, external APIs, and user-facing surfaces.
  3. Map operations: configuration, local setup, build, test, deploy, monitoring, backup, rollback, and any server connection instructions found in the repository.
  4. Review security using the actual stack: secrets, input validation, authn/authz, dependency and supply-chain risk, file/network access, logging, errors, CI permissions, containers, and exposed configuration.
  5. Review engineering health: test coverage, reliability, performance hotspots, maintainability, documentation, TODOs, migrations, release process, and unfinished product work.
  6. Run only safe and relevant existing checks. Record each command and outcome; identify checks that could not run and why.

Safety boundary

  • Keep the audit read-only unless the user explicitly approves a fix.
  • Do not connect to servers, use credentials, call production APIs, scan networks, or run destructive commands without separate explicit authorization.
  • Do not reveal secrets or private data. Cite a redacted location instead.
  • Separate verified facts, reasonable concerns, and unknowns.

Required output

Return these sections: executive summary; scope and coverage; system map; build, test, deploy, and server posture; prioritized findings; quick wins; recommended roadmap; unknowns and excluded scope; and commands or sources inspected.

Rank findings P0–P3. Every finding needs evidence (path:line, configuration key, test result, or reproducible command), impact, smallest sensible fix, and validation method. End with the three highest-leverage actions and request approval before remediation.

What ships with it: 1 file

199 B alongside SKILL.md

agents/

Gives 0 of the 12 instructions most audit compliance skills give in 406 tokens

Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07

  • Fetch latest guidelines before each reviewin 43 of 937, across 3 files
  • group findings by severityin 43 of 937
  • Check files against all fetched rulesin 42 of 937, across 2 files
  • Output findings in terse file:line formatin 41 of 937, across 3 files
  • Ask user which files to review if none specifiedin 41 of 937, across 3 files
  • Read specified files or prompt user for filesin 39 of 937, across 1 file
  • generate the audit reportin 33 of 937, across 30 files
  • assign a severity to every findingin 25 of 937
  • run automated accessibility scansin 23 of 937, across 13 files
  • output a markdown audit reportin 22 of 937
  • map findings to WCAG criteriain 20 of 937, across 10 files
  • confirm audit scopein 19 of 937, across 9 files

Said here and by no other author read

  • inventory tracked and untracked files
  • map the system architecture and data flow
  • map build test and deploy operations
  • review security using the actual stack
  • review engineering health and unfinished work
  • separate verified facts concerns and unknowns

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.