audit-and-fix

Audit an existing codebase and autonomously implement triaged fixes as verified local commits.

83|8|Updated Jun 9, 2026
One-click install
npx skills add https://github.com/nelsonwerd/idea-to-ship-skills --skill audit-and-fix-nelsonwerd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-and-fix
Source: https://github.com/nelsonwerd/idea-to-ship-skills/tree/main/skills/audit-and-fix
Command: npx skills add https://github.com/nelsonwerd/idea-to-ship-skills --skill audit-and-fix-nelsonwerd

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Teams often know a codebase has problems but lack a disciplined path from "here's what's wrong" to verified, reviewable fixes. This Skill closes that gap by orchestrating a read-only audit, a value-based triage of findings, and autonomous implementation of the fixes worth making — each landed as a receipted local commit with an honest ledger of what was and was not proven. ## Core Features & Use Cases - Orchestrated audit-to-fix pipeline: Composes deep-dive (read-only audit), triage, prompt-pack (fix planning), and build-loop (per-unit implementation) without reimplementing any of them. - Single human gate: One mandatory approval between the audit and the first write; everything after the go runs autonomously, stopping at local commits — never pushing, merging, tagging, or publishing. - Receipt discipline and regression fence: Every build-phase verification is wrapped in a receipt tool, a frozen core is proven zero-diff, and a pre-change non-regression oracle proves the system was enhanced, not damaged. - Resumable runs: A durable status ledger plus unit-ID commit subjects make multi-hour, multi-million-token runs resumable with the one-word command resume. - Use Case: Point it at a repo before a live test: it audits the code, triages findings against your next goal, gets your one go, then implements the fixes unit by unit — delivering a commit table, verification grades, and a defer list of what was deliberately not fixed. ## Quick Start Ask the agent to audit this repository and fix what it finds, then review the triage verdict and say go to let it implement the fixes as local commits.

Frequently Asked Questions about audit-and-fix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a repo and automatically fix the findings?▼

Invoke the skill with a phrase like "audit this repo and fix what you find." It runs a read-only deep-dive audit, triages findings against your next goal, asks for one go, then implements fixes autonomously as verified local commits.

What is the difference between deep-dive and audit-and-fix?▼

deep-dive answers "is it sound?" and stops at a read-only briefing. audit-and-fix continues past the audit: it triages what's worth fixing, gets one approval, and implements the fixes as receipted commits. Use deep-dive when you have no intent to change code.

Can audit-and-fix push commits or merge branches automatically?▼

No. It stops at local commits, always. Push, merge, tag, publish, spending money, or touching live accounts are hard gates requiring your own explicit, in-the-moment request after the run ends at the honest ledger.

What happens if a long audit-and-fix run hits a usage limit?▼

Say "resume" with no further input. The skill locates its run state, reconciles the status ledger against git truth (git wins), discards any half-done unit, and continues at the first unit not proven landed — never re-running landed units.

When should I not use audit-and-fix?▼

Avoid it for audits with no intent to change (use deep-dive), changes you already know you want (use prompt-pack plus build-loop), greenfield ideas (use autopilot), feature work, non-git repos, or repos with no verification surface like pure documentation.

Does a green test suite from audit-and-fix prove the fixes are correct?▼

No. Receipts record that named commands passed against a sealed tree — evidence, not proof of correctness. Live-account, real-money, and first-CI-run behaviors remain human gates that the run explicitly never clears.