audit-integrity · diff
v1.0 to v1.1
27 added, 33 removed. Audit A to A.
---
- name: 'audit-integrity'
- description: 'Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.'
- compatibility: 'Cross-platform. Works with any language or framework analyzed by AppSec agents.'
+ name: audit-integrity
+ description: "Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery."
+ license: MIT
metadata:
- version: '1.0'
+ version: "1.1"
---
# Audit Integrity Skill
- Enforces output quality, intellectual honesty, and continuous improvement across all AppSec agents.
+ Enforce output quality, intellectual honesty, and continuous improvement across security audits and code reviews.
## When to Use
- - Every security analysis, code review, threat model, or quality scan agent run
- - Applied automatically as a post-analysis quality gate
- - Applicable to any agent performing SAST, SCA, threat modeling, or code quality analysis
+ - Perform security analyses, threat models, code reviews, or quality audits.
+ - Validate that every finding has verified code evidence and taint flow.
+ - Prevent the suppression or rationalization of security findings.
+ - Evaluate draft reports against the quality gate threshold (score ≥ 8/10).
+ - Record lessons learned and security memories after you complete a scan.
## Components
- This skill provides 7 reusable capabilities. Agents apply all 7 unless their scope excludes a specific component.
+ This skill provides 7 modular capabilities in the `references/` directory. Load each file when you reach its execution phase:
- | Component | Reference File | Purpose |
- |-----------|---------------|---------|
- | Clarification Protocol | [clarification-protocol.md](references/clarification-protocol.md) | Ask ≤2 targeted questions before analysis when scope is ambiguous |
- | Anti-Rationalization Guard | [anti-rationalization-guard.md](references/anti-rationalization-guard.md) | Table of prohibited rationalizations with mandatory responses |
- | Self-Critique Loop | [self-critique-loop.md](references/self-critique-loop.md) | Mandatory second-pass review after initial analysis |
- | Retry Protocol | [retry-protocol.md](references/retry-protocol.md) | Tool failure handling — retry once, then document |
- | Non-Negotiable Behaviors | [non-negotiable-behaviors.md](references/non-negotiable-behaviors.md) | Hard rules: never fabricate, always cite evidence, report gaps |
- | Self-Reflection Quality Gate | [self-reflection-quality-gate.md](references/self-reflection-quality-gate.md) | 1–10 scoring rubric with ≥8 threshold per category |
- | Self-Learning System | [self-learning-system.md](references/self-learning-system.md) | Lesson/Memory templates and governance rules |
+ | Component | Reference File | Purpose |
+ | ---------------------------- | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+ | Clarification Protocol | [references/clarification-protocol.md](references/clarification-protocol.md) | Ask a maximum of 2 targeted questions when scope is not clear |
+ | Anti-Rationalization Guard | [references/anti-rationalization-guard.md](references/anti-rationalization-guard.md) | Prohibited rationalizations and mandatory responses for findings |
+ | Self-Critique Loop | [references/self-critique-loop.md](references/self-critique-loop.md) | Mandatory second pass to verify evidence and coverage |
+ | Retry Protocol | [references/retry-protocol.md](references/retry-protocol.md) | Tool failure and empty search handling: retry once, then document |
+ | Non-Negotiable Behaviors | [references/non-negotiable-behaviors.md](references/non-negotiable-behaviors.md) | Mandatory rules: do not fabricate, cite evidence, report gaps |
+ | Self-Reflection Quality Gate | [references/self-reflection-quality-gate.md](references/self-reflection-quality-gate.md) | Scoring rubric (1–10 scale) with a minimum threshold of 8 |
+ | Self-Learning System | [references/self-learning-system.md](references/self-learning-system.md) | Templates and rules for lessons and security memories |
## Execution Flow
- 1. **Before analysis**: Apply Clarification Protocol if scope is ambiguous
- 2. **During analysis**: Apply Anti-Rationalization Guard at every decision point
- 3. **After initial pass**: Execute Self-Critique Loop (mandatory second pass)
- 4. **On tool failure**: Apply Retry Protocol
- 5. **Before delivery**: Run Self-Reflection Quality Gate (all categories must score ≥8)
- 6. **After delivery**: Create Lessons/Memories for novel findings, false positives, or methodology gaps (see Self-Learning System)
-
- ## Agent-Specific Adaptation
-
- Each agent customizes the **Self-Critique Loop** checklist and **Self-Reflection Quality Gate** categories to match its domain. The reference files provide the base templates; agents extend them with domain-specific items.
+ Load reference files as you reach each phase:
- ### Example extensions per agent type
- - **SAST/SCA agents**: Add taint trace completeness and manifest coverage checks
- - **SonarQube-style agents**: Add rating sanity check (A–E consistency with findings)
- - **Threat modeling agents**: Add STRIDE category completeness per trust boundary
- - **Code review agents**: Add trust boundary audit with data flow tracing
+ 1. **Before analysis**: If scope or policy is not clear, read [references/clarification-protocol.md](references/clarification-protocol.md). Ask a maximum of 2 targeted questions.
+ 2. **During analysis**: Follow [references/non-negotiable-behaviors.md](references/non-negotiable-behaviors.md). At each triage decision, consult [references/anti-rationalization-guard.md](references/anti-rationalization-guard.md).
+ 3. **On tool or search failure**: Follow [references/retry-protocol.md](references/retry-protocol.md). Do not assume code is secure without verification.
+ 4. **After initial analysis**: Complete a second pass with the checklist in [references/self-critique-loop.md](references/self-critique-loop.md). Verify taint traces and manifest coverage.
+ 5. **Before delivery**: Score the draft report using [references/self-reflection-quality-gate.md](references/self-reflection-quality-gate.md). All categories must score ≥ 8.
+ 6. **Final delivery**: Record lessons and memories using [references/self-learning-system.md](references/self-learning-system.md).