provider-audit

Manage audit logging providers for system events with JSONL or database storage.

5|2|Updated Feb 8, 2026
One-click install
npx skills add https://github.com/project-ax/ax --skill provider-audit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: provider-audit
Source: https://github.com/project-ax/ax/tree/main/.claude/skills/ax/provider-audit
Command: npx skills add https://github.com/project-ax/ax --skill provider-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill manages and provides access to audit logs, ensuring that all significant actions and events within the system are recorded for security and debugging purposes.

Core Features & Use Cases

  • Comprehensive Logging: Records IPC actions, LLM calls, and security events.
  • Flexible Storage: Supports both simple JSONL append-only files and robust database-backed storage (SQLite/PostgreSQL).
  • Querying Capabilities: Allows filtering and retrieval of audit entries based on various criteria like action, session ID, and timestamps.
  • Use Case: Investigate a security incident by querying all actions performed within a specific session or by a particular user.

Quick Start

Query the audit logs for all 'llm_call' actions within the last 24 hours.

Frequently Asked Questions about provider-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I record security events and LLM calls in audit logs?

Audit logging records IPC actions, LLM calls, and security events by appending entries to JSONL files or a database, ensuring all significant system actions are captured for security and debugging.

What is the best way to query audit logs by session ID and time range?

Querying audit logs by session ID and time range involves applying filters for action type, session ID, and timestamps to retrieve matching entries from either JSONL files or database-backed storage.

Can I use SQLite or PostgreSQL for database-backed audit logging?

Yes, database-backed audit logging supports SQLite and PostgreSQL via a shared DatabaseProvider, allowing you to store and query system events with robust relational database capabilities.

Does audit logging work with JSONL file storage?

Yes, audit logging supports JSONL file storage as an append-only format, providing a simple, file-based alternative for recording system events without requiring a database backend.

How do I investigate a security incident using audit logs?

To investigate a security incident using audit logs, query all actions performed within a specific session or by a particular user by filtering on action type, session ID, and time range.