Skills

Skill 35 of 200

Audit Integrity

Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards…

1 minute · 304 words · 6 sections

Install

$ npx skills add github/awesome-copilot --skill audit-integrity

$ npx skills add github/awesome-copilot

» /plugin marketplace add github/awesome-copilot

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Audit Integrity Skill

Enforces output quality, intellectual honesty, and continuous improvement across all AppSec agents.

When to Use

Every security analysis, code review, threat model, or quality scan agent run
Applied automatically as a post-analysis quality gate
Applicable to any agent performing SAST, SCA, threat modeling, or code quality analysis

Components

This skill provides 7 reusable capabilities. Agents apply all 7 unless their scope excludes a specific component.

Component	Reference File	Purpose
Clarification Protocol	clarification-protocol.md (opens in a new tab)	Ask ≤2 targeted questions before analysis when scope is ambiguous
Anti-Rationalization Guard	anti-rationalization-guard.md (opens in a new tab)	Table of prohibited rationalizations with mandatory responses
Self-Critique Loop	self-critique-loop.md (opens in a new tab)	Mandatory second-pass review after initial analysis
Retry Protocol	retry-protocol.md (opens in a new tab)	Tool failure handling — retry once, then document
Non-Negotiable Behaviors	non-negotiable-behaviors.md (opens in a new tab)	Hard rules: never fabricate, always cite evidence, report gaps
Self-Reflection Quality Gate	self-reflection-quality-gate.md (opens in a new tab)	1–10 scoring rubric with ≥8 threshold per category
Self-Learning System	self-learning-system.md (opens in a new tab)	Lesson/Memory templates and governance rules

Execution Flow

Before analysis: Apply Clarification Protocol if scope is ambiguous
During analysis: Apply Anti-Rationalization Guard at every decision point
After initial pass: Execute Self-Critique Loop (mandatory second pass)
On tool failure: Apply Retry Protocol
Before delivery: Run Self-Reflection Quality Gate (all categories must score ≥8)
After delivery: Create Lessons/Memories for novel findings, false positives, or methodology gaps (see Self-Learning System)

Each agent customizes the Self-Critique Loop checklist and Self-Reflection Quality Gate categories to match its domain. The reference files provide the base templates; agents extend them with domain-specific items.

Example extensions per agent type

SAST/SCA agents: Add taint trace completeness and manifest coverage checks
SonarQube-style agents: Add rating sanity check (A–E consistency with findings)
Threat modeling agents: Add STRIDE category completeness per trust boundary
Code review agents: Add trust boundary audit with data flow tracing

About this skill

Trigger

Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Compatibility: Cross-platform. Works with any language or framework analyzed by AppSec agents.
Source: skills/audit-integrity/SKILL.md

Colophon for this issue

Colophon

How this issue was made

Source

github.com/github/awesome-copilot, branch main, last pushed 24 September 2026.

Licence

MIT — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

200 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 2 distinct layouts observed: .github/skills/*/SKILL.md, skills/*/SKILL.md.

Authorship

3 of 200 skills are installed into the repository rather than published from it. They are shelved in the closing “Credited skills” part and remain the work of their own authors. A skill counts as credited when its only copy lives under one agent’s dot directory; visible directories, per-agent mirror sets, and skills installable from this repository on skills.sh all count as published.

Issue colours

Resolved from a curated brand profile — hue 295°, chroma 0.190. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Shifted “6 headings” from h1 to h2 so the skill title is the only h1.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .github/plugin/marketplace.json by GitHub, declaring 162 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /github/awesome-copilot.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Audit Integrity Skill

Enforces output quality, intellectual honesty, and continuous improvement across all AppSec agents.

When to Use

Every security analysis, code review, threat model, or quality scan agent run
Applied automatically as a post-analysis quality gate
Applicable to any agent performing SAST, SCA, threat modeling, or code quality analysis

Components

This skill provides 7 reusable capabilities. Agents apply all 7 unless their scope excludes a specific component.

Component	Reference File	Purpose
Clarification Protocol	clarification-protocol.md (opens in a new tab)	Ask ≤2 targeted questions before analysis when scope is ambiguous
Anti-Rationalization Guard	anti-rationalization-guard.md (opens in a new tab)	Table of prohibited rationalizations with mandatory responses
Self-Critique Loop	self-critique-loop.md (opens in a new tab)	Mandatory second-pass review after initial analysis
Retry Protocol	retry-protocol.md (opens in a new tab)	Tool failure handling — retry once, then document
Non-Negotiable Behaviors	non-negotiable-behaviors.md (opens in a new tab)	Hard rules: never fabricate, always cite evidence, report gaps
Self-Reflection Quality Gate	self-reflection-quality-gate.md (opens in a new tab)	1–10 scoring rubric with ≥8 threshold per category
Self-Learning System	self-learning-system.md (opens in a new tab)	Lesson/Memory templates and governance rules

Execution Flow

Before analysis: Apply Clarification Protocol if scope is ambiguous
During analysis: Apply Anti-Rationalization Guard at every decision point
After initial pass: Execute Self-Critique Loop (mandatory second pass)
On tool failure: Apply Retry Protocol
Before delivery: Run Self-Reflection Quality Gate (all categories must score ≥8)
After delivery: Create Lessons/Memories for novel findings, false positives, or methodology gaps (see Self-Learning System)

Agent-Specific Adaptation

Example extensions per agent type

SAST/SCA agents: Add taint trace completeness and manifest coverage checks
SonarQube-style agents: Add rating sanity check (A–E consistency with findings)
Threat modeling agents: Add STRIDE category completeness per trust boundary
Code review agents: Add trust boundary audit with data flow tracing

Audit Integrity

Audit Integrity Skill

When to Use

Components

Execution Flow

Agent-Specific Adaptation

Example extensions per agent type

About this skill

Trigger

Colophon

Audit Integrity

Audit Integrity Skill

When to Use

Components

Execution Flow

Agent-Specific Adaptation

Example extensions per agent type

Appendix 35.1–35.7

ReferencesMarkdown · 7 files

About this skill

Trigger

Colophon

Appendix 35.1–35.7

ReferencesMarkdown · 7 files