rails-audit-thoughtbot

Audit Rails codebases for testing, security, and design issues.

232|13|Updated Jan 9, 2026

Search Tags:#code quality #testing #code review #security #thoughtbot #rails audit

Ready to run

npx skills add https://github.com/thoughtbot/rails-audit-thoughtbot --skill rails-audit-thoughtbot-thoughtbot

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: rails-audit-thoughtbot
Source: https://github.com/thoughtbot/rails-audit-thoughtbot/tree/main
Command: npx skills add https://github.com/thoughtbot/rails-audit-thoughtbot --skill rails-audit-thoughtbot-thoughtbot

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Auditors and developers gain a structured, repeatable assessment of a Rails application's quality across testing practices, security, design, and performance, based on thoughtbot's Ruby Science and Testing Rails guidance.

Core Features & Use Cases

Comprehensive audit coverage of tests (RSpec), security vulnerabilities, code design (POROs, skinny controllers, ActiveModel patterns), Rails conventions, migrations hygiene, and performance considerations.
Generates a detailed markdown audit report grouped by category (Testing, Security, Models, Controllers, Code Design, Views) with severity levels (Critical, High, Medium, Low).
Useful for code reviews, quality assessments, or ongoing compliance checks across Rails projects.

Quick Start

Run the audit from the root of a Rails project to generate a comprehensive RAILS_AUDIT_REPORT.md.

Frequently Asked Questions about rails-audit-thoughtbot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a Rails codebase for security vulnerabilities and code quality issues?▼

To audit a Rails codebase for security and code quality, run an assessment from the project root that scans testing practices, security vulnerabilities, and code design, generating a markdown report grouped by category with severity levels.

What does a Rails code review cover for testing practices and ActiveModel patterns?▼

A Rails code review covers RSpec testing practices, security vulnerabilities, code design including POROs and ActiveModel patterns, Rails conventions, migrations hygiene, and performance considerations to assess overall application quality.

Can I generate a structured report for Rails best practices and compliance checks?▼

Yes, you can generate a detailed markdown audit report grouped by categories like Testing, Security, Models, Controllers, Code Design, and Views, with severity levels ranging from Critical to Low for compliance checks.

Does the Rails audit check for skinny controllers and Rails conventions?▼

Yes, the Rails audit checks for skinny controllers, Rails conventions, and ActiveModel patterns as part of its code design assessment, applying thoughtbot best practices to evaluate the application architecture.

How are code quality findings categorized and prioritized in a Rails audit?▼

Code quality findings are categorized into groups like Testing, Security, Models, Controllers, Code Design, and Views, then prioritized using severity levels of Critical, High, Medium, and Low to guide remediation efforts.