claude-audit-skills

A pre-ship audit suite for [Claude Code](https://claude.com/claude-code) — 13 skills under one plugin. Run any audit on its own, or `/audit:all` to orchestrate the whole suite into a single combined scorecard.

This is a Claude Code plugin marketplace. The whole suite installs as one plugin (audit); every audit is then an individually invocable, namespaced command (/audit:security, /audit:a11y, …). One install, no per-repo sprawl, no drift between siblings.

The audits

Every audit is report-only by default; the ones that can remediate take an opt-in --fix. All findings carry file:line evidence, and each skill enforces its own anti-hallucination rules (no invented identifiers, evidence-mandated findings).

Install

# 1. Add this marketplace (Git-based; owner/repo shorthand):
/plugin marketplace add soreavis/claude-audit-skills

# 2. Install the suite:
/plugin install audit@soreavis-skills

# 3. Activate without restarting:
/reload-plugins

Then run any audit, e.g.:

/audit:security --fix
/audit:all --tier=full --scope=src/ --report
/audit:a11y

Team setup (project .claude/settings.json):

{
  "extraKnownMarketplaces": {
    "soreavis-skills": {
      "source": { "source": "github", "repo": "soreavis/claude-audit-skills" }
    }
  },
  "enabledPlugins": {
    "audit@soreavis-skills": true
  }
}

/audit:all tiers

/audit:all                                   # standard tier
/audit:all --tier=full --skip=hallucination  # everything except the AI-risk pass
/audit:all --tier=quick --include=a11y       # compose tier + include/skip

(/audit:diff isn't part of a run-all — it compares two existing reports. Run /audit:all twice across a fix sprint, then /audit:diff.)

Layout

claude-audit-skills/
├── .claude-plugin/
│   └── marketplace.json          # lists the `audit` plugin
└── plugins/
    └── audit/
        ├── .claude-plugin/plugin.json
        └── skills/
            ├── all/SKILL.md       → /audit:all
            ├── security/SKILL.md  → /audit:security
            ├── deep/SKILL.md      → /audit:deep
            └── …                  (13 skills total)

Requirements

• Claude Code
• Your target project checked out locally — the skills use Grep / Glob / Read against the codebase
• For --report / --fix reports: a _local/ directory (skills create one if needed)

No external services. No API keys. Pure methodology + Claude Code execution.

License

MIT — copy it, ship it, improve it.

Acknowledgments

Built with Claude Code. Vector and checklist catalogs assembled from OWASP, WCAG 2.1, web.dev, GDPR / ISO 27001:2022, and real shipping experience.