audit-runner

Executes external Claude Code setup audit protocols and triages findings through discussion review.

Updated Aug 17, 2026
One-click install
npx skills add https://github.com/kai-kou/gem-hunter --skill audit-runner-kai-kou
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-runner
Source: https://github.com/kai-kou/gem-hunter/tree/main/.claude/skills/audit-runner
Command: npx skills add https://github.com/kai-kou/gem-hunter --skill audit-runner-kai-kou

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Third-party audit protocols for Claude Code setups produce scores and findings that reflect the protocol author's preferences, not your repository's actual needs. This Skill runs such protocols faithfully, then filters each finding through a multi-lens discussion review so only genuinely applicable improvements become Issues, implementations, and merged PRs. ## Core Features & Use Cases - Faithful protocol execution: Fetches the audit protocol fresh on every run, executes all phases without modification, and records before/after scorecards using the same protocol version. - Discussion-based triage: Routes every finding through a 4-lens adversarial review (spec compliance, design coherence, security, cost-benefit) that returns adopt/defer/reject verdicts instead of blindly chasing score improvements. - Autonomous follow-through: Converts adopted findings into GitHub Issues via MCP tools, implements them on branches, creates and merges PRs, then re-audits and reports the before/after diff including improvements the score cannot capture. - Use Case: On a monthly schedule, the Skill fetches the latest claude-code-ultimate-guide audit prompt, audits your repository setup, debates the 12 findings, adopts 4 real defects, rejects 5 author-specific conventions, merges the fixes, and reports that sandboxing now actually works even though the score barely moved. ## Quick Start Ask the AI to run the audit-runner skill to execute the setup audit protocol, review the findings, implement the adopted ones, and re-audit for a before/after report.

Frequently Asked Questions about audit-runner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my Claude Code setup with an external protocol?▼

Invoke the audit-runner skill by asking to run the setup audit. It fetches the protocol fresh via curl, executes every phase without modification, saves the before scorecard, and then triages findings through a discussion review before implementing anything.

Should I implement every finding from a Claude Code audit?▼

No. Audit scores reflect the protocol author's values, not your repository's reality. This Skill routes each finding through a 4-lens discussion review covering spec compliance, design coherence, security, and cost-benefit, and only adopt-verdict items become Issues and PRs.

Can audit-runner run on a schedule without user interaction?▼

Yes. It supports scheduled execution via a Routine trigger with permission_mode set to auto, and it disallows AskUserQuestion so it never blocks on dialog. Items needing user confirmation become waiting-user Issues with a Slack notification instead.

Does audit-runner use the gh CLI for GitHub operations?▼

No. In cloud execution environments gh is not reliably available, so all GitHub operations go through mcp__github__* MCP tools as the primary path. Any gh commands in documentation are read as their MCP equivalents.

Why does the re-audit reuse the same protocol version?▼

The after-audit reuses the protocol file saved at the start of the cycle rather than re-fetching it. Using the same version ensures the before/after score diff reflects actual improvements rather than changes in the protocol itself.

What are the limitations of automated setup audits?▼

External protocols cannot distinguish between a setting being written and a setting being effective, and they may penalize intentional design choices or volatile cloud-environment configurations. This Skill mitigates that by treating scores as discussion input, never as adoption criteria.