Project Audit Council banner

Project Audit Council

Audit a repository like a review board of principal engineers, security specialists, QA reviewers, database specialists, DevOps engineers, and skeptical red-team reviewers.

Project Audit Council is a reusable Agent Skill and plugin package for Codex, Claude Code, and compatible tooling that consumes SKILL.md-based workflows. It pushes agents toward evidence, separation of confirmed findings from suspicions, and safer audit behavior by default.

Quick Start

Use the repository plugin package when you want installation, versioning, and marketplace discovery.

Codex

codex plugin marketplace add Munizada/project-audit-council
codex plugin add project-audit-council@project-audit-council

Invoke the packaged skill:

$project-audit-council audit this repository in deep mode. Do not modify files.

Claude Code

claude plugin marketplace add Munizada/project-audit-council
claude plugin install project-audit-council@project-audit-council

Invoke the packaged skill:

/project-audit-council:project-audit-council audit this repository in deep mode. Do not modify files.

Manual Agent Skill

Codex:

git clone https://github.com/Munizada/project-audit-council.git
mkdir -p ~/.agents/skills
cp -R project-audit-council/skills/project-audit-council ~/.agents/skills/

Claude Code:

git clone https://github.com/Munizada/project-audit-council.git
mkdir -p ~/.claude/skills
cp -R project-audit-council/skills/project-audit-council ~/.claude/skills/

Why Project Audit Council?

Most scanners are narrow. Most AI reviews are too eager to speculate. Project Audit Council is designed to be the middle ground that serious engineering teams actually need: broad repository coverage, skeptical evidence standards, and a workflow that treats business logic and production readiness as first-class concerns rather than afterthoughts.

This project exists to make repository audits more operational:

• consistent across runs
• portable across tools
• useful before and after releases
• careful with secrets and destructive actions
• honest about what was tested versus what still needs verification

What It Audits

• Build, install, runtime, test, lint, format, and type-check paths
• Authentication, authorization, IDOR, role escalation, and state abuse
• Backend route validation, transactions, idempotency, and error behavior
• Frontend route guards, token handling, mock leaks, and client trust boundaries
• Database constraints, ownership modeling, migrations, and data integrity
• Dependency, lockfile, and supply-chain risk
• Secrets exposure, dangerous defaults, and misconfigured logging
• Docker, CI, deployment, health checks, and production readiness
• Architecture boundaries, dead code, coupling, duplication, and maintainability

How the Council Works

The skill runs a multi-pass audit flow:

1. repository discovery
2. safe command planning
3. specialist review passes
4. skeptical review and deduplication
5. final report with severity, evidence, impact, fix guidance, and regression-test recommendations

The default posture is analysis-only. It does not modify files unless the user explicitly asks for a remediation pass after the audit.

Audit Modes

• quick: fast structural review and top risks
• standard: balanced full-repository audit
• deep: default multi-pass audit with broader verification
• paranoid: maximum scrutiny for auth, abuse, secrets, state changes, and production hardening
• diff: review current changes instead of the whole repository
• fix-plan: produce a remediation sequence without editing code

Installation

Detailed installation notes live in docs/INSTALLATION.md.

Codex

Public install:

codex plugin marketplace add Munizada/project-audit-council
codex plugin add project-audit-council@project-audit-council

Local validation:

codex plugin marketplace add .
codex plugin list --available --json

Claude Code

Public install:

claude plugin marketplace add Munizada/project-audit-council
claude plugin install project-audit-council@project-audit-council

Interactive equivalents:

/plugin marketplace add Munizada/project-audit-council
/plugin install project-audit-council@project-audit-council
/reload-plugins

Manual Agent Skill

If your tool supports the Agent Skills layout but not these plugin systems, copy skills/project-audit-council/ into the tool's expected skills directory. Compatibility notes are in docs/COMPATIBILITY.md.

Usage

Recommended prompt:

Use Project Audit Council to audit this repository in deep mode.
Do not modify files.
Run safe existing validation commands when available.
Separate confirmed findings from suspicions.
For every confirmed finding, include file path, evidence, impact, recommended fix, and regression-test guidance.

Example Prompts

Use Project Audit Council in paranoid mode. Focus on auth, authorization, secrets, state transitions, payment logic, and production readiness.

Use Project Audit Council on only the backend and database layers. Keep the audit analysis-only.

Use Project Audit Council in diff mode for the current changes and challenge every high-severity claim before finalizing.

More examples live in examples/usage.md.

Activation boundaries are intentionally narrow:

• it should activate for repository audits, PR or diff audits, red-team reviews, production checks, systemic bug investigations, and remediation planning
• it should not activate for ordinary feature implementation, single-function explanations, variable renames, formatting-only work, or other small localized edits unless the user explicitly asks for an audit

Evidence Standard

Confirmed findings require evidence. A strong report ties every issue to one or more of:

• file paths and code snippets
• command output
• configuration values
• runtime behavior
• reproducible reasoning grounded in the repository

Weak guesses should be labeled as Suspicion / Needs verification, not promoted to confirmed defects.

Safety Model

Project Audit Council is analysis-only by default.

It is allowed to inspect files and run safe existing checks. It is not allowed to:

• run destructive commands
• rewrite history
• publish secrets
• call external write APIs
• install arbitrary production dependencies
• claim absolute security guarantees

Report Output

The report template expects:

• executive summary
• project snapshot
• commands executed and results
• confirmed findings by severity
• suspicions that still need verification
• production-readiness notes
• recommended fix order
• verification plan

See skills/project-audit-council/references/report-template.md.

Repository Structure

project-audit-council/
|-- .agents/plugins/marketplace.json
|-- .claude-plugin/
|   |-- marketplace.json
|   `-- plugin.json
|-- .codex-plugin/plugin.json
|-- .github/
|-- assets/
|-- docs/
|-- examples/
|-- plugins/project-audit-council/
|-- scripts/
`-- skills/project-audit-council/
    |-- SKILL.md
    |-- references/
    |-- scripts/
    `-- templates/

Validation

Run the full validation suite locally and in CI:

python scripts/run_validation_suite.py

Or run the individual commands directly:

python scripts/sync_packaging.py
python scripts/validate_repo.py
python -m compileall scripts skills/project-audit-council/scripts
python -m unittest discover -s tests -v
python skills/project-audit-council/scripts/audit_probe.py --root . --json
git diff --check

Examples, Evals, and Benchmark

• invocation examples: examples/auto-invocation.md, examples/explicit-invocation.md
• audit examples: examples/full-audit-example.md, examples/diff-audit-example.md, examples/skeptical-review-example.md
• synthetic report example: examples/synthetic-benchmark-report.md
• activation eval dataset: evals/dataset.json
• synthetic benchmark manifest: benchmark/manifest.json

Links

• Profile: https://github.com/Munizada
• Repository: https://github.com/Munizada/project-audit-council
• Issues: https://github.com/Munizada/project-audit-council/issues
• Releases: https://github.com/Munizada/project-audit-council/releases
• Latest release: https://github.com/Munizada/project-audit-council/releases/latest
• Security: https://github.com/Munizada/project-audit-council/security

Compatibility

Roadmap

• Publish community feedback and compatibility reports
• Add live eval execution guidance for Codex and Claude Code runs
• Add more stack-specific references where they improve signal
• Expand benchmark fixtures only when they add clear coverage value

Contributing

Contributions should keep the skill portable, evidence-based, and conservative around destructive actions. Start with CONTRIBUTING.md.

Security

For vulnerabilities, prefer GitHub Private Vulnerability Reporting when enabled for the repository. See SECURITY.md.

License

MIT. See LICENSE.

Disclaimer

Project Audit Council is a third-party community project by Munizada. It is compatible with Codex, Claude Code, and the Agent Skills ecosystem, but it is not an official OpenAI or Anthropic product and does not claim exhaustive vulnerability detection or absolute security guarantees.