audit-reliability

Audits codebases for ISO/IEC 25010 reliability weaknesses and produces a severity-classified findings report.

11|1|Updated Jul 25, 2025
Ready to run
npx skills add https://github.com/tomzx/agents --skill audit-reliability-tomzx
💬 Prompt for ChatGPT / Claude Chat▼
Please help me install this Agent Skill.
Skill: audit-reliability
Source: https://github.com/tomzx/agents/tree/main/skills/audit-reliability
Command: npx skills add https://github.com/tomzx/agents --skill audit-reliability-tomzx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Codebases often contain hidden reliability weaknesses—swallowed exceptions, network calls without timeouts, missing retries, non-idempotent writes, and absent health checks—that only surface as production outages or data loss. This Skill statically scans the repository for these design flaws and reports them by severity before they cause incidents. ## Core Features & Use Cases - Exception Handling Audit: Detects bare or over-broad exception handlers and logged-but-swallowed errors in Python, TypeScript, JavaScript, and Java code. - Fault Tolerance & Availability Checks: Finds external calls without timeouts, missing retry/backoff or circuit breakers, missing health/readiness endpoints, and absent graceful-shutdown handling. - Recoverability Analysis: Flags non-idempotent writes, multi-step writes without transaction boundaries, and background jobs without clear delivery semantics. - Use Case: Before scaling a service to multiple instances, run the audit to surface single-instance assumptions like hardcoded singletons and in-memory state that would break under horizontal scaling. ## Quick Start Ask the agent to run a reliability audit on the current repository, optionally scoped to a directory such as src/payments, and review the severity-classified findings report.

Frequently Asked Questions about audit-reliability

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my codebase for reliability issues?▼

Run the reliability audit from the repository root to statically scan for swallowed exceptions, missing timeouts on network calls, absent retries, and non-idempotent writes. Results are classified by severity from critical to low in a findings report.

What does an ISO/IEC 25010 reliability audit check?▼

It covers the four reliability sub-characteristics: maturity (fragile exception patterns), availability (health endpoints, graceful shutdown, single points of failure), fault tolerance (timeouts, retries, circuit breakers), and recoverability (transactions, idempotency, data durability).

How to find network calls without timeouts in Python?▼

The audit uses ripgrep to locate requests, httpx, fetch, axios, grpc, boto3, and database client calls, then filters out lines containing timeout settings. Each unguarded call site is flagged with file, line, and severity.

Does the reliability audit modify my code?▼

No, the audit is strictly read-only and leaves no artifacts in the repository. Any confirmation scripts are written to /tmp, executed there, and never committed to the codebase.

What is the difference between reliability audit and observability audit?▼

The reliability audit checks whether the system is designed to tolerate and recover from failure, while audit-observability checks whether failures are instrumented. observe-production covers runtime failures happening right now.

Can I scope the reliability audit to one service?▼

Yes, pass a path argument such as --path src/payments to focus the scan on a specific service boundary. You can also filter findings with --severity critical, high, medium, or low.