audit-common

Normalizes evidence, severity, redaction, and finding schemas across privacy audit workflows.

2|Updated May 6, 2026
One-click install
npx skills add https://github.com/bpcakes/jig-skills --skill audit-common-bpcakes
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-common
Source: https://github.com/bpcakes/jig-skills/tree/main/plugins/jig-privacy-audit/skills/audit-common
Command: npx skills add https://github.com/bpcakes/jig-skills --skill audit-common-bpcakes

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Privacy audits produce inconsistent findings when each reviewer applies different severity scales, evidence standards, and redaction rules. This Skill provides shared rules so every audit finding uses the same evidence levels, severity definitions, and machine-readable schema. ## Core Features & Use Cases - Shared Evidence Standards: Defines high, medium, and low evidence levels based on audit-grade artifacts like file paths, HAR entries, storage snapshots, and reproduction steps. - Consistent Severity Model: Classifies findings from critical to informational based on impact and exposure rather than pattern counts. - Finding Schema: Ships a JSON Schema (templates/finding.schema.json) for machine-readable findings with stable IDs, affected claims, evidence entries, and retest steps. - Use Case: A team auditing a zero-knowledge encryption product uses this Skill to ensure network, storage, and cryptography audit findings all follow the same severity scale and redaction rules before being merged into one report. ## Quick Start Ask the agent to normalize your privacy audit findings using the shared evidence levels, severity definitions, and finding schema from the audit-common support rules.

Frequently Asked Questions about audit-common

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I standardize severity ratings across privacy audit findings?

Apply the shared severity model that rates findings from critical to informational based on impact and exposure, not pattern counts. Critical covers plaintext or key recovery at scale, while missing documentation alone is a limitation, not a defect.

What evidence is required for a privacy audit finding?

Audit-grade evidence includes file paths with line numbers, HAR entries, request IDs, storage snapshots, database rows, logs, screenshots, and reproduction steps. Evidence is graded high, medium, or low depending on how directly the behavior was observed.

Can this skill be run standalone for a full privacy audit?

No, it is a support skill that narrower audit skills read directly for shared rules. In Codex, agents/openai.yaml disables automatic standalone selection, and Claude installations should avoid selecting it alone.

How should secrets and personal data appear in audit reports?

Redact secrets, tokens, credentials, private keys, personal data, and live customer content in final output. Preserve enough structure in the redacted excerpts so findings remain retestable.

What are the limitations of network traffic analysis in privacy audits?

Absence of a sentinel string in network traffic is limited evidence: it can disprove simple plaintext leakage but cannot prove correct cryptography. Findings must distinguish confirmed defects from hypotheses and missing evidence.