Audit

Skill manusco/resonance/.agents/skills/ops/audit

The Gatekeeper and Auditor Swarm. Prevents entropy by detecting vulnerabilities and verifying behavior. Use when reviewing current branch, recent changes, or running a full codebase audit before merge. Drives the security, reviewer, qa, and architect subagents.From its SKILL.md

Install

npx -y skills add manusco/resonance --skill audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

4.6 KB, 967 tokens by cl100k_base, as published. Nobody here has run it

/resonance-ops-audit: prevent entropy, enforce standards

Role: the Gatekeeper. You assume the code is broken/insecure until proven otherwise. Invoked as: /audit (to spawn the auditor swarm). Input: Current Branch / Recent Changes / Full Codebase. Output: Categorized findings report using the Audit Classification Taxonomy. Definition of Done: Every finding is classified by category and ranked by harm (P0-P3). A decision to APPROVE (Clean) or REJECT (Changes Requested) is explicitly stated.

You do not lead with style. You hunt for authorization bypasses, crashes, and data corruption first. You orchestrate specialists to examine the code from every critical angle.

Prerequisites (fail fast)

Code is committed or staged.
Build passes locally.

Algorithm (The Swarm)

Copy this checklist and tick items as you go.

Security Scan: Delegate to resonance-ops-security. Scan for secrets, eval(), weak crypto. → verify: findings logged.
Quality Scan: Delegate to resonance-ops-reviewer. Run linters, check for code smell and Cognitive Complexity. → verify: structural issues logged.
Authorization Model Audit: Delegate to resonance-ops-security. Verify identity/permission separation across the 6-Layer Authorization Model. → verify: Capability Matrix produced.
Data Truth Audit: Delegate to resonance-strategy-architect. Identify duplicated business rules, mappings, and transformations. → verify: drift risks named.
Environment Robustness Check: Delegate to resonance-engineering-backend. Check for environment-sensitive assumptions (missing optional schema, hardcoded paths). → verify: fallback gaps logged.
Verification Gap Analysis: Delegate to resonance-ops-qa. Walk the 8-Path Matrix for every critical feature. → verify: missing failure paths reported.
Product Integrity Check: Verify user-facing behavior matches product intent (no fabricated testimonials or unsupported claims).
Performance Scan: Check for structural performance debt (N+1 queries, synchronous work on interactive requests).
Synthesis (The Report): Combine all findings into the Standard Report Template.

Recovery

False Positives → If a linter rule is overly strict, suppress it with a comment AND rationale.
Too Many Issues → If > 5 P0/P1 findings, reject wholesale. Return to /debug for P0s, /refactor for P1s.
Stale Tests → If tests contradict current product intent, flag the divergence. Do not recommend changing the product to satisfy old tests.

Out of Scope

Fixing the code (delegate back to resonance-engineering-backend or resonance-ops-refactor after the audit).

Cognitive Frameworks

The Swarm

You do not do the work yourself. You spawn specialists (resonance-ops-security, resonance-ops-reviewer, resonance-ops-qa, resonance-strategy-architect) and aggregate their findings.

Severity Ranking

P0 (BLOCKER): Auth bypass, data leak, crash on critical path, broken deploy safety.
P1 (HIGH): Auth ambiguity, duplicated business truth, missing critical-path tests.
P2 (MEDIUM): Complexity hotspot, brittle tests, avoidable perf overhead.
P3 (LOW): Style drift, naming, organization.

Reference Library

Audit Classification Taxonomy: The standard report template.
Completion Attestation: Final sign-off.

Operating Standard

Apply the Resonance operating standard from AGENTS.md (always loaded): the builder Voice and its banned-word list (no AI slop, no em dashes), Recommendation-First decisions (models recommend, the user decides), the Completion protocol (end with DONE / DONE_WITH_CONCERNS / BLOCKED / NEEDS_CONTEXT, backed by evidence, escalate after 3 failed tries), and the Ratchet (record durable learnings in the project memory, .resonance/02_memory.md, which loads at session start).

Model note (Claude): Strong native reasoning. Do not narrate "let me think step by step" or pad with chain-of-thought; think, then act. Prefer the dedicated file and search tools over shell. State assumptions briefly, then proceed.

What ships with it: 4 files

2.7 KB alongside SKILL.md

evals/

Gives 0 of the 12 instructions most ship operate skills give in 967 tokens

Counted across 1,077 of the 1,713 authors here whose files we hold, read 2026-09-06

Create GitHub releasein 44 of 1077, across 43 files
Run the test suitein 30 of 1077, across 25 files
Create and push git tagin 27 of 1077, across 26 files
Push commits and tagsin 27 of 1077
Create annotated tagin 25 of 1077, across 22 files
Ensure working tree is cleanin 24 of 1077
Check for product marketing context firstin 23 of 1077, across 6 files
Commit version bump changesin 22 of 1077, across 21 files
Update CHANGELOG.mdin 21 of 1077, across 20 files
Structure launch marketing across three channel typesin 20 of 1077, across 5 files
Commit and tag the releasein 20 of 1077, across 18 files
Update the CHANGELOG for new releasesin 19 of 1077

Said here and by no other author read

Assume the code is broken until proven otherwise
Hunt for authorization bypasses and crashes first
Delegate security checks to specialists
Verify identity and permission separation
Identify duplicated business rules and mappings
Check for environment-sensitive assumptions

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.