audit-item SKILL.md skillA
audit-item from ninjasln-labs/agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add ninjasln-labs/agent-skills/audit-item@v1.1.0Pins v1.1.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- ninjasln-labs/agent-skills
- Path
audit-item/SKILL.md- Versions recorded
- 4
- Latest version
- v1.1.0, committed Sep 29, 2026
- First version recorded
- Aug 16, 2026
- Size
- 6,928 bytes
- Repository stars
- 3
- License
- none declared
Track audit/review findings as numbered issue files (audit-items/NNN-slug.md, under the directory the project keeps such findings) with id, severity, source audit, status (open/fixed/recorded), fix commit, regression test, and closing evidence, plus a summary index README that the stage-completion gate enumerates. Use when an audit or review produces findings and the user asks to record them (e.g. "log the audit findings"). USER-INVOKED ONLY: it writes tracked files — the agent must not…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Audit Item（审计问题 issue 化跟踪）
## 定位
审计/评审产出的发现 → 编号 issue 文件 + 汇总索引，让每个发现可追踪到关闭，
且**可被 stage-gate 枚举**（门禁「审计状态」断言核对 open 项）。
## 何时使用
- 审计/评审产出发现后：「把审计发现入账」「审计项」
- 覆盖矩阵缺口、code-review 阶段评审、文档审计、领域审计——任何来源的发现
## 目录约定
- 单条：`audit-items/NNN-slug.md`（NNN = 顺序编号，slug = kebab）
- 索引：`audit-items/README.md`（汇总表）
- 目录不存在 → 创建（含 README 骨架）
## 模板（字段必填）
```markdown
# A-NNN {标题}
- id: NNN
- 严重度: high | medium | low
- 来源审计: {报告路径 + 轮次/章节，如 docs/audits/intent-confirmation-impl-audit.md §S2}
- 状态: open | fixed | recorded
- 修复 commit: {hash（fixed 时）}
- 回归测试: {测试文件::用例（fixed 时）}
- 关闭证据: {链接/命令输出尾部（fixed/recorded 时）}
## 发现
{现象 + 证据 + 影响}
## 关闭条件
{可勾选：修复 commit 存在 / 回归测试红→绿 / 证据链接}
```
## 状态流转
```
open ──修复──→ fixed（修复 commit + 回归测试 + 关闭证据，三缺一不算 fixed）
open ──裁决──→ recorded（裁决不修：记录理由，不再要求修复——门禁视为已收）
```
- **fixed**：修复 commit 可查 + 回归测试证明（红→绿或等价证据）+ 关闭证据链接。
- **recorded**：明确裁决不修（如「V2 规模待拍板」）——理由写入关闭证据；与 fixed 同样满足门禁。
- 状态变更时更新 README 索引行（状态 + 关闭证据列）。
## 索引 README
```markdown
# Audit Items 索引
| # | 标题 | 严重度 | 状态 | 来源 | 关闭证据 |
|---|------|--------|------|------|---------|
| 001 | … | medium | fixed | … | commit abc + 测试 |
```
…Read the whole file at its exact version.
How to install
mdr add ninjasln-labs/agent-skills/audit-item@sha256:ccae159e39e9d17fThe line at the top of this page pins the label v1.1.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_zniaylbc74w5rne7)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Aug 16, 2026 and Sep 29, 2026, about one every 15 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.1.0 latest | 2026-09-29 | 0febb7a | 6,928 B | A | view · diff |
| v1.0.1 | 2026-09-22 | 75c75c0 | 3,666 B | A | view · diff |
| v1.0.0 | 2026-09-07 | 571fb57 | 3,647 B | A | view · diff |
| git:20260816.abe0a4a | 2026-08-16 | abe0a4a | 3,591 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6928 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
ninjasln-labs/agent-skills · 3 stars · license none declared · pushed 2026-10-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_zniaylbc74w5rne7 GET https://markdownregistry.com/api/v1/resolve?ref=ninjasln-labs/agent-skills/audit-item GET https://markdownregistry.com/api/v1/blob/ccae159e39e9d17f53a55eaa2aac66a5461c25b8877126126357d5da7536aa17
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.