auditing

Name: auditing
Author: OdradekAI

290stars23forks

How to install auditing?

odradekai/bundles-forge/auditing

$npx -y skills add OdradekAI/bundles-forge --skill auditing

Installs into the current project.

Summary

Use when reviewing a bundle-plugin for structural issues, version drift, skill quality, workflow integration, or security risks — before releasing, after changes, or after adding skills. Auto-detects scope (full project vs skill vs workflow)

Files · 1

View on GitHub

SKILL.md

1	# Auditing Bundle-Plugins
2
3	## Overview
4
5	Systematically evaluate a bundle-plugin project or a single skill across applicable quality categories — including security scanning — score each, and produce a diagnostic report. This skill is a pure diagnostic tool: it identifies and reports issues but does not orchestrate fixes.
6
7	Core principle: Measure and report. A scored audit gives orchestrating skills (blueprinting, optimizing, releasing) the information they need to decide what to fix. When sources contradict, apply the authority hierarchy in `references/source-of-truth-policy.md`.
8
9	This skill includes security scanning. No need to invoke a separate security skill — see Category 10 under Full Project Audit.
10
11	Announce at start: "I'm using the auditing skill to audit [this project / this skill]."
12
13	Plugin context: When installed as a plugin, operate on the user's project (`$CLAUDE_PROJECT_DIR` / `<target-dir>`), not the plugin's own cache. Read files from and detect scope in the target; write all outputs (reports, JSON baselines) to the workspace's `.bundles-forge/audits/`. See `references/input-normalization.md` for edge-case input types, naming conventions, and security rules. `<plugin-root>` in commands below resolves to `$CLAUDE_PLUGIN_ROOT` (Claude Code), `$CURSOR_PLUGIN_ROOT` (Cursor), or `.` (local development).
14
15	## Resolve Input & Detect Scope
16
17	The target can be a local path, a GitHub URL, or a zip file. Normalize to a local directory, then detect scope. This applies to all three audit modes.
18
19	### Input Normalization
20
21	This is a mandatory step — do not skip it or improvise paths. Resolve the target to a local directory before proceeding to Scope Detection or any audit Step 1.
22
23	1. Resolve the workspace. The workspace is `$CLAUDE_PROJECT_DIR` or `$CURSOR_PROJECT_DIR` (plugin mode), falling back to the current working directory.
24	2. Normalize the target by type:
25	- Local path — use directly; no transformation needed.
26	- GitHub URL — parse `<owner>` and `<repo>` from the URL. Shallow-clone to `<workspace>/.bundles-forge/repos/<owner>__<repo>/` using `--depth 1 --no-checkout`, then run `git checkout`. If the directory already exists, append a `__<YYYYMMDD>` timestamp to avoid collisions. Do not clone to `/tmp/`, `~/`, or any path outside `.bundles-forge/repos/`.
27	- Zip/tar.gz — extract to `<workspace>/.bundles-forge/repos/<archive-name>/`.
28	3. Create the target subdirectory if it does not exist.
29	4. On failure (network error, 404, auth required, rate limit): tell the user what failed and suggest providing a local path or zip file instead. Do not silently skip or proceed with partial data.
30
31	See `references/input-normalization.md` for the full naming convention (version/timestamp suffixes), GitHub subdirectory URLs, and security rules.
32
33	### Scope Detection
34
35	After normalization, determine the audit scope from the resolved local path:
36
37	\| Target \| How to Detect \| Mode \|
38	\|--------\|--------------\|------\|
39	\| Project root \| Has `skills/` directory \| Full audit — all 10 categories \|
40	\| Project root + workflow request \| User explicitly requests workflow audit, or specifies `--focus-skills` \| Workflow audit — 3-layer workflow checks (W1-W11) \|
41	\| Single skill directory \| Contains `SKILL.md` but no `skills/` subdirectory \| Skill audit — 4 applicable categories \|
42	\| Single SKILL.md file \| Path ends in `SKILL.md` \| Skill audit — 4 applicable categories \|
43
44	If the target is a single skill, skip to the Skill Audit section below.
45	If a workflow audit is requested, skip to the Workflow Audit section below.
46
47	---
48
49	## Full Project Audit
50
51	`audit-plugin` orchestrates `audit-security` (security), `audit-skill` (skill quality), `audit-workflow` (workflow integration), and `audit-docs` (documentation consistency D1-D9), then adds structure, manifest, version-sync, hook, and testing checks.
52
53	Categories at a glance (see `references/plugin-checklist.md` for 60+ individual checks):
54
55	\| Category \| Weight \|
56	\|----------\|--------\|
57	\| Structure \| High \|
58	\| Platform Manifests \| Medium \|
59	\| Version Sync \| High \|
60	\| Skill Quality \| Medium \|
61	\| Cross-References \| Medium \|
62	\| Workflow \| High \|
63	\| Hooks \| Medium \|
64	\| Testing \| Medium \|
65	\| Documentation \| Low \|
66	\| Security \| High \|
67
68	Security Scan (Category 10): Scans 7 attack surfaces. See `references/security-checklist.md` for the full pattern list. `security-checklist.md`

People who liked this also viewed

6 picks

Type

auditing

290stars23forks

View on GitHub

How to install auditing?

odradekai/bundles-forge/auditing

$npx -y skills add OdradekAI/bundles-forge --skill auditing

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Auditing Bundle-Plugins
2
3	## Overview
4
5	Systematically evaluate a bundle-plugin project or a single skill across applicable quality categories — including security scanning — score each, and produce a diagnostic report. This skill is a pure diagnostic tool: it identifies and reports issues but does not orchestrate fixes.
6
7	Core principle: Measure and report. A scored audit gives orchestrating skills (blueprinting, optimizing, releasing) the information they need to decide what to fix. When sources contradict, apply the authority hierarchy in `references/source-of-truth-policy.md`.
8
9	This skill includes security scanning. No need to invoke a separate security skill — see Category 10 under Full Project Audit.
10
11	Announce at start: "I'm using the auditing skill to audit [this project / this skill]."
12
13	Plugin context: When installed as a plugin, operate on the user's project (`$CLAUDE_PROJECT_DIR` / `<target-dir>`), not the plugin's own cache. Read files from and detect scope in the target; write all outputs (reports, JSON baselines) to the workspace's `.bundles-forge/audits/`. See `references/input-normalization.md` for edge-case input types, naming conventions, and security rules. `<plugin-root>` in commands below resolves to `$CLAUDE_PLUGIN_ROOT` (Claude Code), `$CURSOR_PLUGIN_ROOT` (Cursor), or `.` (local development).
14
15	## Resolve Input & Detect Scope
16
17	The target can be a local path, a GitHub URL, or a zip file. Normalize to a local directory, then detect scope. This applies to all three audit modes.
18
19	### Input Normalization
20
21	This is a mandatory step — do not skip it or improvise paths. Resolve the target to a local directory before proceeding to Scope Detection or any audit Step 1.
22
23	1. Resolve the workspace. The workspace is `$CLAUDE_PROJECT_DIR` or `$CURSOR_PROJECT_DIR` (plugin mode), falling back to the current working directory.
24	2. Normalize the target by type:
25	- Local path — use directly; no transformation needed.
26	- GitHub URL — parse `<owner>` and `<repo>` from the URL. Shallow-clone to `<workspace>/.bundles-forge/repos/<owner>__<repo>/` using `--depth 1 --no-checkout`, then run `git checkout`. If the directory already exists, append a `__<YYYYMMDD>` timestamp to avoid collisions. Do not clone to `/tmp/`, `~/`, or any path outside `.bundles-forge/repos/`.
27	- Zip/tar.gz — extract to `<workspace>/.bundles-forge/repos/<archive-name>/`.
28	3. Create the target subdirectory if it does not exist.
29	4. On failure (network error, 404, auth required, rate limit): tell the user what failed and suggest providing a local path or zip file instead. Do not silently skip or proceed with partial data.
30
31	See `references/input-normalization.md` for the full naming convention (version/timestamp suffixes), GitHub subdirectory URLs, and security rules.
32
33	### Scope Detection
34
35	After normalization, determine the audit scope from the resolved local path:
36
37	\| Target \| How to Detect \| Mode \|
38	\|--------\|--------------\|------\|
39	\| Project root \| Has `skills/` directory \| Full audit — all 10 categories \|
40	\| Project root + workflow request \| User explicitly requests workflow audit, or specifies `--focus-skills` \| Workflow audit — 3-layer workflow checks (W1-W11) \|
41	\| Single skill directory \| Contains `SKILL.md` but no `skills/` subdirectory \| Skill audit — 4 applicable categories \|
42	\| Single SKILL.md file \| Path ends in `SKILL.md` \| Skill audit — 4 applicable categories \|
43
44	If the target is a single skill, skip to the Skill Audit section below.
45	If a workflow audit is requested, skip to the Workflow Audit section below.
46
47	---
48
49	## Full Project Audit
50
51	`audit-plugin` orchestrates `audit-security` (security), `audit-skill` (skill quality), `audit-workflow` (workflow integration), and `audit-docs` (documentation consistency D1-D9), then adds structure, manifest, version-sync, hook, and testing checks.
52
53	Categories at a glance (see `references/plugin-checklist.md` for 60+ individual checks):
54
55	\| Category \| Weight \|
56	\|----------\|--------\|
57	\| Structure \| High \|
58	\| Platform Manifests \| Medium \|
59	\| Version Sync \| High \|
60	\| Skill Quality \| Medium \|
61	\| Cross-References \| Medium \|
62	\| Workflow \| High \|
63	\| Hooks \| Medium \|
64	\| Testing \| Medium \|
65	\| Documentation \| Low \|
66	\| Security \| High \|
67
68	Security Scan (Category 10): Scans 7 attack surfaces. See `references/security-checklist.md` for the full pattern list. `security-checklist.md`

People who liked this also viewed

6 picks

Type