Audit

Skill Sagargupta16/craftsmanship/skills/audit

Skills that encode engineering discipline -- plan, guard, verify, review, audit, ship. Compatible with 45+ AI agents via skills.sh.

Install

npx -y skills add Sagargupta16/craftsmanship --skill audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when setting up a new repo, auditing an existing one for hygiene issues, or before publishing a project. Covers .gitignore, .env.example, README, LICENSE, CONTRIBUTING, and detecting committed secrets.

SKILL.md

5.4 KB, ~1.3k tokens by cl100k_base, as published. Nobody here has run it

Repository Hygiene Audit

Essential Files Checklist

File	Purpose	Why It Matters
`README.md`	Project overview, quick start	First impression, onboarding
`LICENSE`	Legal terms for use	Without one, code is "all rights reserved" by default
`.gitignore`	Files to exclude from git	Prevents committing secrets, build artifacts
`.env.example`	Template for env vars	Shows structure without revealing secrets
`CONTRIBUTING.md`	How to contribute	Reduces friction for contributors
`CHANGELOG.md`	Version history	Users track what changed
`CODE_OF_CONDUCT.md`	Community expectations	Required for many registries

.gitignore Essentials

Minimum patterns for any repo:

# Secrets
.env
.env.local
.env.*.local

# OS
.DS_Store
Thumbs.db
desktop.ini

# Editors
.vscode/
.idea/
*.swp
*.swo
*~

# Logs
*.log
logs/

# Dependencies (language-specific)
node_modules/
__pycache__/
*.pyc
.venv/
venv/
target/
vendor/

# Build artifacts
dist/
build/
out/
*.egg-info/

# Coverage
coverage/
.coverage
htmlcov/

Language additions:

Node: node_modules/, dist/, .next/, .turbo/
Python: __pycache__/, *.pyc, .venv/, venv/, .pytest_cache/, .mypy_cache/
Rust: target/, Cargo.lock (for libs, commit for bins)
Go: vendor/, bin/
Terraform: .terraform/, *.tfstate*, *.tfvars (if contains secrets)
Java: target/, .gradle/, *.class

README Essentials

Minimum sections:

# Project Name

One-line tagline.

## Why
What problem does this solve?

## Install
Exact commands to install.

## Quick Start
Minimal working example.

## Usage
Common use cases with code examples.

## License
License name with link to LICENSE file.

Nice to have:

Badges (build status, version, license)
Screenshots/GIFs for visual tools
Link to docs site
Contributing section (even if just linking CONTRIBUTING.md)
Acknowledgments / credits

.env.example Pattern

# Database
DATABASE_URL=postgresql://user:password@localhost:5432/dbname

# Auth
JWT_SECRET=change-me-to-a-long-random-string
OAUTH_CLIENT_ID=your-oauth-client-id
OAUTH_CLIENT_SECRET=your-oauth-client-secret

# External APIs
OPENAI_API_KEY=sk-...
AWS_REGION=us-east-1

# Feature flags
ENABLE_BETA_FEATURES=false

Rules:

Every variable the app reads at runtime
Placeholder values that look like the real thing (so users know the format)
Comments grouping related vars
Never real credentials

Secret Scanning

Before publishing a repo publicly, scan for leaked secrets:

# Check git history for common patterns
git log -p | grep -iE 'api[_-]?key|secret|password|token|bearer' | grep -v example

# Dedicated tools
gitleaks detect --source=. --verbose
trufflehog git file://. --only-verified

# GitHub's own scanner runs automatically on public repos

If secrets are found in history:

Rotate them immediately
Use git filter-repo or BFG to remove from history
Force-push cleaned history
Enable GitHub secret scanning for the repo going forward

LICENSE Choice

License	When to Use
MIT	Permissive, short, widely used. Best default for most projects
Apache 2.0	Like MIT but with patent protection. Larger projects, corporate use
GPL-3.0	Copyleft -- derivatives must also be GPL. Strong software freedom
BSD-3-Clause	Very permissive, slightly different from MIT
Unlicense / CC0	Public domain, no restrictions
Proprietary	Internal/commercial code. No file = "all rights reserved"

Generate: https://choosealicense.com

Config File Hygiene

Commit: package.json, requirements.txt, Dockerfile, tsconfig.json
Commit with placeholders: .env.example, config.example.yml
Do NOT commit: .env, config.yml (with real values), node_modules/, build artifacts
Lock files (package-lock.json, yarn.lock, Cargo.lock, poetry.lock): commit for apps, skip for libs

Auditing an Existing Repo

1. Check for .gitignore -- does it cover your stack?
2. Check for README -- is it accurate and useful?
3. Check for LICENSE -- is there one?
4. Check for .env.example -- if app uses env vars
5. Scan for committed secrets (gitleaks)
6. Check for outdated dependencies
7. Check CI status -- is it green?
8. Check stale branches -- prune or merge
9. Check for TODO/FIXME density -- tech debt signal
10. Check commit message quality -- conventional commits?

Anti-Patterns

Anti-Pattern	Problem	Do Instead
No README	Users can't onboard	Even a 5-line README helps
README listing what code does	Duplicates the code	Focus on WHY and HOW TO USE
No LICENSE	"All rights reserved" by default -- users can't legally use it	Pick one from choosealicense.com
Committing `.env`	Secrets leaked forever	Use `.env.example`, add `.env` to `.gitignore`
Broken links in README	Unprofessional, frustrating	Test links periodically
Outdated dependencies with CVEs	Security risk	Automated updates (Renovate, Dependabot)
Empty CONTRIBUTING.md	Signals unmaintained	Either write one or remove file

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most audit compliance skills give in ~1.3k tokens

Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07

Fetch latest guidelines before each reviewin 43 of 937, across 3 files
Group findings by severityin 43 of 937
Check files against all fetched rulesin 42 of 937, across 2 files
Output findings in terse file:line formatin 41 of 937, across 3 files
Ask user which files to review if none specifiedin 41 of 937, across 3 files
Read specified files or prompt user for filesin 39 of 937, across 1 file
Generate the audit reportin 33 of 937, across 30 files
Assign a severity to every findingin 25 of 937
Run automated accessibility scansin 23 of 937, across 13 files
Output a markdown audit reportin 22 of 937
Map findings to WCAG criteriain 20 of 937, across 10 files
Confirm audit scopein 19 of 937, across 9 files

Said here and by no other author read

include a gitignore file
add standard ignore patterns for secrets
add language-specific ignore patterns
include a readme file
write the readme focusing on why and how to use
provide an env example file

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.