AU

audit-and-fix

A safe, multi-stage workflow to analyze code and apply validated fixes.

Install

mkdir -p .claude/skills/audit-and-fix && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12371" && unzip -o skill.zip -d .claude/skills/audit-and-fix && rm skill.zip

Installs to .claude/skills/audit-and-fix

Activation

This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.

Structured audit-then-remediate workflow: investigate read-only, write findings to a research file, then apply fixes via cost-routed subagents. Use when the user asks to analyse / audit / review something and (potentially) fix the issues found. Enforces human-approval gates before editing and before committing.
312 chars✓ has a “when” triggerlonger than Claude Code's old 250-char listing cap (fine on current versions)
Advanced

Key capabilities

  • Frame questions for an audit based on user requests and obvious adjacent issues.
  • Conduct read-only investigations using parallel subagents.
  • Write findings to a structured research file including what, where, why it matters, and proposed fixes.
  • Summarize findings and obtain user approval for scope and actions before making changes.
  • Convert approved fixes into exact, unambiguous edit specifications.
  • Delegate execution of fixes to a general-purpose subagent.

How it works

The skill first performs a read-only investigation, documenting findings in a research file, then seeks user approval for the scope and proposed fixes before applying changes through delegated subagents.

Inputs & outputs

You give it
A request to analyze, audit, or review something with potential fixes.
You get back
A structured research file with findings and proposed fixes, followed by applied and verified changes upon user approval.

When to use audit-and-fix

  • Auditing configuration files
  • Fixing bugs in modules
  • Analyzing codebase for issues

About this skill

Audit and Fix

A repeatable workflow for "analyse X, tell me what's wrong, and fix it." It separates investigation from change, routes each kind of work to the cheapest model that can do it well, and stops for the user's approval at three fixed points.

When to use

  • "Analyse / audit / review my <config|module|codebase> and fix the issues."
  • Any task that is investigation first, changes second, where the changes depend on what the investigation turns up.

Do not use for: a single known edit, a pure question with no remediation, or work where the user has already decided exactly what to change.

Core principles

  • Investigation is read-only. No edits, no setup changes, no commits until Gate 1 is passed.
  • The research file is the deliverable of the analysis, not the chat message. Write it before you summarise (see CLAUDE.md "Research & findings").
  • Right model for the job (see cheatsheet below): keep reasoning on the strong model, push mechanical work down to the cheapest model that can do it.
  • Verify conclusions yourself. Subagent summaries are leads, not proof — for any nuanced finding (a conflict, a clobbered option, a subtle bug) read the actual file:line before asserting it.
  • The user drives scope and decisions. Never expand scope or pick between user-facing options unilaterally.

Workflow

Phase 1 — Investigate (read-only, fan-out)

  1. Frame the questions the audit must answer (the user's explicit asks plus the obvious adjacent ones — e.g. misconfig, overlap/conflict, redundancy).
  2. Fan out read-only Explore subagents in parallel (max 3) to map structure and gather the relevant config/code. Give each a distinct focus. Use 1 agent if the scope is small/known.
  3. Pull the critical files into the main context and read them yourself to confirm anything you intend to report as a finding.

Phase 2 — Write findings → research file

Write to .claude/research/yyyy-mm-dd-title.md. Structure it so each finding has: what, where (file:line), why it matters, and a proposed fix. Group by severity (real bugs / redundant / overlaps-conflicts / opportunities). Include any "leave as-is, intentional" notes so the user knows you considered them. End with a suggested order of work.

🛑 GATE 1 — Scope sign-off (REQUIRED, before any change)

Summarise the findings in chat, link the research file, then use AskUserQuestion to settle:

  • report-only vs. apply fixes,
  • which findings to action,
  • appetite for any larger refactors / migrations surfaced.

Make no edits until this is answered.

Phase 3 — Resolve decisions

Turn each approved fix into an exact change. Where a fix involves a genuine judgement call the user owns — a keybinding, a config value, a name, a trade-off between options — do not guess.

🛑 GATE 2 — Decision sign-off (REQUIRED if any such choices exist)

Batch every open choice into a single AskUserQuestion (recommended option first, labelled). Only skip this gate if the approved fixes are purely mechanical with no user-facing choice.

Phase 4 — Apply fixes (delegated, lightest model)

  1. Convert the approved, decided fixes into exact, unambiguous edit specs (precise old → new strings, or full file contents) — the spec must carry all the judgement so the executor needs none.
  2. Delegate execution to one general-purpose subagent. Batch fixes that share files/context under that single agent — do not spawn an agent per file.
  3. Pick the model per the cheatsheet below: Haiku for fully-specified mechanical edits; keep anything still needing reasoning on the main agent or a Sonnet subagent.

Phase 5 — Verify

  • Run the project's formatter / linter / syntax check (for this repo: stylua . from the nvim config dir; syntax-check Lua where useful).
  • Revert incidental out-of-scope changes (e.g. a formatter touching files you didn't intend to change) so the diff stays scoped to the task.
  • Review the diff yourself and confirm each hunk matches the intended fix.

🛑 GATE 3 — Commit sign-off (REQUIRED)

Report what changed (concise per-fix summary + git diff --stat). Do not commit unless the user asks. Offer to commit on a branch; let the user review and commit.

Model selection cheatsheet

WorkWhoModelWhy
Orchestration, analysis, framing the fixes, judgementmain agent (this session)strong (Opus / session default)needs reasoning and holds the running context
Broad read-only search / codebase mappingExplore subagents, ≤3 in parallelSonnet (or inherit)cheap, good synthesis, cannot edit
Mechanical, fully-specified editsone general-purpose subagentHaikucheapest; the spec removes the need to reason
An edit needing judgement a spec can't capturemain agent, or a Sonnet subagentSonnet+correctness over cost for the ambiguous bit

When not to use it

  • For a single known edit.
  • For a pure question with no remediation.
  • For work where the user has already decided exactly what to change.

Limitations

  • Investigation is strictly read-only until Gate 1 is passed.
  • The skill requires user approval at three fixed points: scope sign-off, decision sign-off, and commit sign-off.
  • The skill does not expand scope or pick between user-facing options unilaterally.

How it compares

This skill enforces a structured audit-then-remediate workflow with multiple human approval gates, separating investigation from change and routing work to cost-effective models, unlike a direct fix approach.

Compared to similar skills

audit-and-fix side by side with the closest alternatives in the catalog.

SkillInstallsUpdatedSafetyDifficulty
audit-and-fix (this skill)02moNo flagsAdvanced
find-bugs57moNo flagsIntermediate
tech-debt-analyzer59moReviewIntermediate
static-analysis56moNo flagsAdvanced

Try saying

Example prompts that trigger this skill in your AI assistant.

You might also like

find-bugs

davila7

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

529

tech-debt-analyzer

ailabs-393

This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation.

522

static-analysis

gmh5225

Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.

518

agent-code-analyzer

ruvnet

Agent skill for code-analyzer - invoke with $agent-code-analyzer

317

codex-code-review

tyrchen

Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.

16

review-code

catlog22

Multi-dimensional code review with structured reports. Analyzes correctness, readability, performance, security, testing, and architecture. Triggers on "review code", "code review", "审查代码", "代码审查".

22

Search skills

Search the agent skills registry