AuditThis.ai

Install

Install the skill

The auditthis.ai method as an installable skill for development assistants, version 2.3.0.

Skill

What the skill does

The skill gives a development assistant the auditthis.ai method and its 3 prompts at version 2.3.0, in the open Agent Skills format (specification (opens in a new tab)). It has 3 modes:

  • Applicability: which references and tools apply to your project, with the trigger each meets and the evidence for it. Read-only, with no findings.
  • Assessment: the planning and audit prompts for your own project, or the review prompt for something you use but do not own, unchanged.
  • Change review: a partial assessment of the changes between 2 revisions, labelled partial, keeping the finding IDs of your latest report.

It carries no text from any reference: it fetches each one at run time. At each use it checks the published version and tells you when a newer one exists.

Download

Download and verify

Archive
auditthis-skill-2.3.0.zip
SHA-256
ac858e80c9b8f4d79136a028c8fa17c671a988af5d294a33115f36284820f959
Checksums
SHA256SUMS

Check the archive before you install it, against the checksum file here and against the independent record at posluns.dev/hashes.txt (opens in a new tab), where each release of the skill is listed as auditthis-skill once its maintainer has published it there:

sha256sum -c SHA256SUMS
sha256sum auditthis-skill-2.3.0.zip

Both values must match. The archive holds 1 folder, auditthis/, with SKILL.md, the method, the 3 prompts, the register as data, and the licence.

Install

Install

  • Claude Code, for yourself: unpack the archive so that the folder is ~/.claude/skills/auditthis/.
  • Claude Code, for a project and its team: unpack it so that the folder is .claude/skills/auditthis/ in the repository, and commit it.
  • Another assistant that reads Agent Skills: put the auditthis/ folder where that assistant's documentation says skills go.
  • Any other assistant: use the prompts directly; the page for AI assistants gives the fetch order.

Use

Use

Ask in your own words, for example “Which auditthis references apply to this project?”, “Plan an assessment of this project with auditthis”, or “Review the changes since the last release with auditthis”. In Claude Code you can also type /auditthis followed by the request. The skill never starts on its own initiative, changes nothing, and stops where the prompts stop to ask you.

CI

In continuous integration

A change review can run on each pull request. The workflow below is a starting point for a repository that holds the skill in .claude/skills/auditthis/. It is untested: it uses only options that Claude Code's documentation describes (read-only built-in tools, no prompting, a turn limit, and the report in the run log), but that documentation gives no tested read-only setup that posts nothing. Try it on a test repository first.

name: auditthis change review
on: pull_request
permissions:
  contents: read
  # The action's default GitHub App authentication needs id-token.
  id-token: write
env:
  BASE: ${{ github.event.pull_request.base.sha }}
  HEAD: ${{ github.event.pull_request.head.sha }}
jobs:
  change-review:
    runs-on: ubuntu-latest
    steps:
      # actions/checkout v4.4.0
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          fetch-depth: 0
      # anthropics/claude-code-action v1.0.99
      - uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: >-
            /auditthis change review of ${{ env.BASE }}
            to ${{ env.HEAD }}.
            Write the report to the run log. Post nothing.
          claude_args: >-
            --tools "Read,Grep,Glob,WebFetch"
            --permission-mode dontAsk
            --max-turns 40

It sends the changed code to Anthropic's API under your key. Keep the repository's access read-only, pin each action to a full commit, and treat the result as partial: it covers the change, never the whole project.

Limits

Limits

  • The skill is a copy of the method at 1 version; the published files at this site are canonical.
  • It does not authorize anything: active checks still need the written authorization the method requires, and it never runs an active tool in a change review or an outside-in review.
  • Nothing it produces makes a project compliant, secure, or complete.