weekly-audit-patterns SKILL.md skillA
weekly-audit-patterns from amd/gaia is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add amd/gaia/weekly-audit-patterns@git:20261004.f4f409aPins git:20261004.f4f409a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- amd/gaia
- Path
.claude/skills/weekly-audit-patterns/SKILL.md- Versions recorded
- 5
- Latest version
- git:20261004.f4f409a, committed Oct 4, 2026
- First version recorded
- Aug 11, 2026
- Size
- 17,615 bytes
- Repository stars
- 1,593
- License
- MIT
The non-obvious invariants of the proactive nightly Claude audit workflow (.github/workflows/claude-nightly-audit.yml): the day-of-week mode selector, the two-key dedup scheme (cluster_key per defect, dedup_key per location) that keeps one defect from becoming N issues, the four audit dimensions (security has its own nightly workflow, claude-security-audit.yml) and which one owns the Fail-Loudly check, and the `bug`-label → auto-fix promotion path. Read before editing that workflow, changing…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Nightly Audit Patterns
`.github/workflows/claude-nightly-audit.yml` is the repo's one **proactive** Claude
lens — a scheduled deep review (not triggered by a PR) that fans out one read-only
Claude job per dimension and files **one issue per defect**. Everything else in
`claude.yml` is reactive. These are the invariants a future editor will otherwise break.
> **Naming:** this ran weekly before it moved to a nightly cron (10:37 UTC ≈ 3am Pacific,
> deep on Sundays). The filename, `name:`, cron, and concurrency group now all say
> **nightly**. Two identifiers still say `weekly` and are correct as they are:
>
> - the **`weekly-audit` label** — a **provenance** label ("a proactive Claude audit filed
> this"), shared with the genuinely-weekly `claude-weekly-doc-walkthrough.yml`. No
> cadence word fits both workflows, so it keeps the neutral name it happens to have;
> its `--description` in both workflows says exactly that.
> - this **skill's `name`**, referenced from `CLAUDE.md`.
>
> An earlier version of this note justified the label by claiming a rename "would re-file
> every open finding." That is **false**, and worth correcting because it is the reasoning
…Read the whole file at its exact version.
How to install
mdr add amd/gaia/weekly-audit-patterns@sha256:ed0299d3bd28910fThe line at the top of this page pins the label git:20261004.f4f409a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_7vzadsc2lmknq2hi)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Aug 11, 2026 and Oct 4, 2026, about one every 13 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261004.f4f409a latest | 2026-10-04 | f4f409a | 17,615 B | A | view · diff |
| git:20260926.bab7d32 | 2026-09-26 | bab7d32 | 17,588 B | A | view · diff |
| git:20260907.d7470a8 | 2026-09-07 | d7470a8 | 17,589 B | A | view · diff |
| git:20260811.7621b22 | 2026-08-11 | 7621b22 | 12,898 B | A | view · diff |
| git:20260811.d086faa | 2026-08-11 | d086faa | 10,061 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (17615 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
amd/gaia · 1,593 stars · license MIT · pushed 2026-10-20 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_7vzadsc2lmknq2hi GET https://markdownregistry.com/api/v1/resolve?ref=amd/gaia/weekly-audit-patterns GET https://markdownregistry.com/api/v1/blob/ed0299d3bd28910fabc1d46aa81336c5e7b04163471bc4f16fe9bbc542a190de
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.