audit-sdlc

Aggregate and rank audit findings from multiple SDLC checks into a report.

5|Updated Jul 25, 2025

Search Tags:#security #dependencies #audit #sdlc #orchestrator #report #churn

Ready to run

npx skills add https://github.com/tomzx/agents --skill audit-sdlc

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-sdlc
Source: https://github.com/tomzx/agents/tree/main/skills/audit-sdlc
Command: npx skills add https://github.com/tomzx/agents --skill audit-sdlc

SYSTEM DOCUMENTATION & REQUIREMENTS

## What problem does it solve? This skill automates the aggregation of multiple audit checks to produce a single, prioritized findings report, reducing manual coordination and ensuring consistent compliance across the project.

## Core Features & Use Cases

Orchestrates audit skills such as audit-dependencies, audit-security, and analyze-git-churn to generate a unified findings set.
Produces the consolidated report at .sdlc/audit-report.md and supports scope-based execution (all, diagnose, Harden, clean, observe, security, quality, etc).
Enables rapid, repeatable audits across projects, enabling trend tracking and issue creation from findings.

### Quick Start Run /audit-sdlc with the desired scope to generate the unified findings report.

Frequently Asked Questions about audit-sdlc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is an SDLC audit and how does it consolidate project findings?▼

An SDLC audit aggregates and ranks findings from multiple security, dependency, and git churn checks into a single actionable report. It orchestrates underlying audit skills to merge results and produce a consolidated markdown file for consistent project compliance.

How do I generate a unified security and dependencies audit report?▼

Run the /audit-sdlc command with your desired scope to generate a unified audit report. The skill invokes enabled dependencies and security checks, reads project context, and writes the consolidated findings to .sdlc/audit-report.md.

Can I run a scoped SDLC audit for just security or code quality?▼

Yes, SDLC audits support scope-based execution including security, quality, diagnose, and harden. You select a chosen scope when running the audit command to filter which underlying checks are aggregated into the final report.

What is the best way to automate git churn and dependency analysis across a project?▼

The best way to automate git churn and dependency analysis is orchestrating these checks into a single audit. This approach merges findings from analyze-git-churn and audit-dependencies skills, reducing manual coordination and producing repeatable results.

Do I need a specific project context directory to aggregate SDLC audit findings?▼

Yes, the audit orchestration reads project context from the .sdlc/context directory to aggregate findings properly. It requires this context to merge results from multiple enabled audit skills and write the consolidated report accurately.