audit-and-fix
A safe, multi-stage workflow to analyze code and apply validated fixes.
Install
mkdir -p .claude/skills/audit-and-fix && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12371" && unzip -o skill.zip -d .claude/skills/audit-and-fix && rm skill.zipInstalls to .claude/skills/audit-and-fix
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Structured audit-then-remediate workflow: investigate read-only, write findings to a research file, then apply fixes via cost-routed subagents. Use when the user asks to analyse / audit / review something and (potentially) fix the issues found. Enforces human-approval gates before editing and before committing.Key capabilities
- →Frame questions for an audit based on user requests and obvious adjacent issues.
- →Conduct read-only investigations using parallel subagents.
- →Write findings to a structured research file including what, where, why it matters, and proposed fixes.
- →Summarize findings and obtain user approval for scope and actions before making changes.
- →Convert approved fixes into exact, unambiguous edit specifications.
- →Delegate execution of fixes to a general-purpose subagent.
How it works
The skill first performs a read-only investigation, documenting findings in a research file, then seeks user approval for the scope and proposed fixes before applying changes through delegated subagents.
Inputs & outputs
When to use audit-and-fix
- →Auditing configuration files
- →Fixing bugs in modules
- →Analyzing codebase for issues
About this skill
Audit and Fix
A repeatable workflow for "analyse X, tell me what's wrong, and fix it." It separates investigation from change, routes each kind of work to the cheapest model that can do it well, and stops for the user's approval at three fixed points.
When to use
- "Analyse / audit / review my <config|module|codebase> and fix the issues."
- Any task that is investigation first, changes second, where the changes depend on what the investigation turns up.
Do not use for: a single known edit, a pure question with no remediation, or work where the user has already decided exactly what to change.
Core principles
- Investigation is read-only. No edits, no setup changes, no commits until Gate 1 is passed.
- The research file is the deliverable of the analysis, not the chat message. Write it before you summarise (see CLAUDE.md "Research & findings").
- Right model for the job (see cheatsheet below): keep reasoning on the strong model, push mechanical work down to the cheapest model that can do it.
- Verify conclusions yourself. Subagent summaries are leads, not proof — for
any nuanced finding (a conflict, a clobbered option, a subtle bug) read the
actual
file:linebefore asserting it. - The user drives scope and decisions. Never expand scope or pick between user-facing options unilaterally.
Workflow
Phase 1 — Investigate (read-only, fan-out)
- Frame the questions the audit must answer (the user's explicit asks plus the obvious adjacent ones — e.g. misconfig, overlap/conflict, redundancy).
- Fan out read-only Explore subagents in parallel (max 3) to map structure and gather the relevant config/code. Give each a distinct focus. Use 1 agent if the scope is small/known.
- Pull the critical files into the main context and read them yourself to confirm anything you intend to report as a finding.
Phase 2 — Write findings → research file
Write to .claude/research/yyyy-mm-dd-title.md. Structure it so each finding has:
what, where (file:line), why it matters, and a proposed fix.
Group by severity (real bugs / redundant / overlaps-conflicts / opportunities).
Include any "leave as-is, intentional" notes so the user knows you considered
them. End with a suggested order of work.
🛑 GATE 1 — Scope sign-off (REQUIRED, before any change)
Summarise the findings in chat, link the research file, then use AskUserQuestion to settle:
- report-only vs. apply fixes,
- which findings to action,
- appetite for any larger refactors / migrations surfaced.
Make no edits until this is answered.
Phase 3 — Resolve decisions
Turn each approved fix into an exact change. Where a fix involves a genuine judgement call the user owns — a keybinding, a config value, a name, a trade-off between options — do not guess.
🛑 GATE 2 — Decision sign-off (REQUIRED if any such choices exist)
Batch every open choice into a single AskUserQuestion (recommended option first, labelled). Only skip this gate if the approved fixes are purely mechanical with no user-facing choice.
Phase 4 — Apply fixes (delegated, lightest model)
- Convert the approved, decided fixes into exact, unambiguous edit specs
(precise
old → newstrings, or full file contents) — the spec must carry all the judgement so the executor needs none. - Delegate execution to one general-purpose subagent. Batch fixes that share files/context under that single agent — do not spawn an agent per file.
- Pick the model per the cheatsheet below: Haiku for fully-specified mechanical edits; keep anything still needing reasoning on the main agent or a Sonnet subagent.
Phase 5 — Verify
- Run the project's formatter / linter / syntax check (for this repo:
stylua .from the nvim config dir; syntax-check Lua where useful). - Revert incidental out-of-scope changes (e.g. a formatter touching files you didn't intend to change) so the diff stays scoped to the task.
- Review the diff yourself and confirm each hunk matches the intended fix.
🛑 GATE 3 — Commit sign-off (REQUIRED)
Report what changed (concise per-fix summary + git diff --stat). Do not
commit unless the user asks. Offer to commit on a branch; let the user review
and commit.
Model selection cheatsheet
| Work | Who | Model | Why |
|---|---|---|---|
| Orchestration, analysis, framing the fixes, judgement | main agent (this session) | strong (Opus / session default) | needs reasoning and holds the running context |
| Broad read-only search / codebase mapping | Explore subagents, ≤3 in parallel | Sonnet (or inherit) | cheap, good synthesis, cannot edit |
| Mechanical, fully-specified edits | one general-purpose subagent | Haiku | cheapest; the spec removes the need to reason |
| An edit needing judgement a spec can't capture | main agent, or a Sonnet subagent | Sonnet+ | correctness over cost for the ambiguous bit |
When not to use it
- →For a single known edit.
- →For a pure question with no remediation.
- →For work where the user has already decided exactly what to change.
Limitations
- →Investigation is strictly read-only until Gate 1 is passed.
- →The skill requires user approval at three fixed points: scope sign-off, decision sign-off, and commit sign-off.
- →The skill does not expand scope or pick between user-facing options unilaterally.
How it compares
This skill enforces a structured audit-then-remediate workflow with multiple human approval gates, separating investigation from change and routing work to cost-effective models, unlike a direct fix approach.
Compared to similar skills
audit-and-fix side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| audit-and-fix (this skill) | 0 | 2mo | No flags | Advanced |
| find-bugs | 5 | 7mo | No flags | Intermediate |
| tech-debt-analyzer | 5 | 9mo | Review | Intermediate |
| static-analysis | 5 | 6mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
find-bugs
davila7
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
tech-debt-analyzer
ailabs-393
This skill should be used when analyzing technical debt in a codebase, documenting code quality issues, creating technical debt registers, or assessing code maintainability. Use this for identifying code smells, architectural issues, dependency problems, missing documentation, security vulnerabilities, and creating comprehensive technical debt documentation.
static-analysis
gmh5225
Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.
agent-code-analyzer
ruvnet
Agent skill for code-analyzer - invoke with $agent-code-analyzer
codex-code-review
tyrchen
Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.
review-code
catlog22
Multi-dimensional code review with structured reports. Analyzes correctness, readability, performance, security, testing, and architecture. Triggers on "review code", "code review", "审查代码", "代码审查".