anonymous /audit-setup

---

name: audit-setup description: Generates scanner, verifier and the /audit skill tailored to the current project, including roadmap reconciliation with roadkeep. Run once per repository.

Generate an audit workflow for THIS project. Do not ask anything you can discover by reading files.

1. Discover (read-only, be economical)

• Stack and languages: package.json, pom.xml, *.csproj, requirements.txt, go.mod.
• Verification commands: test/lint/build scripts, tsconfig, eslintrc, checkstyle.
• Partitions: first/second-level folders containing code, ignoring node_modules, dist, target, .git. Group into 4 to 8 partitions of similar size.
• Conventions: CLAUDE.md, README.
• Roadmap: if roadkeep.toml exists, note which files it owns (ROADMAP.md, IMPROVEMENTS.md, ...) and the exact roadkeep commands available (roadkeep --help). Never edit those files directly; always go through roadkeep.

2. Generate the files (overwrite if they exist)

.claude/agents/scanner.md tools: Read, Grep, Glob · model: sonnet · effort: high Body: fixed output format path:line | issue | why it matters | how to reproduce,

• an 8-12 item checklist SPECIFIC to the detected stack (e.g. for AEM: Sling models without @Optional, unclosed resource resolvers; for GraphQL: N+1 resolvers, fields without null-check; etc.). Never fix anything.

.claude/agents/verifier.md tools: Read, Grep, Glob, Bash · model: opus · effort: xhigh Body, two modes selected by the prompt:

• FINDINGS mode: classify each finding as CONFIRMED / FALSE POSITIVE / UNVERIFIABLE using the project's real verification commands discovered in step 1.
• ROADMAP mode: for each existing open task, check the code and classify as STILL VALID / ALREADY DONE / OUTDATED / NEEDS REWORDING (unclear, too broad, or duplicates a new finding). Output one line per task: task-id | status | evidence (path:line or command) | suggested new text if NEEDS REWORDING. Never modify any file in either mode.

.claude/skills/audit/SKILL.md Script: (1) run the discovered lint/test/build commands; (2) one scanner per partition, in parallel; (3) deduplicate findings; (4) verifier in FINDINGS mode with the full list; (5) if roadkeep is configured: read the open tasks via roadkeep, then run verifier in ROADMAP mode with the task list AND the CONFIRMED findings, so it can spot overlaps; (6) reconcile: mark ALREADY DONE tasks as done, remove OUTDATED, rewrite NEEDS REWORDING, and add CONFIRMED findings not already covered — all via roadkeep commands, then run roadkeep lint. Without roadkeep, write the same to docs/AUDIT.md; (7) report counts only: findings confirmed/false, tasks kept/closed/removed/rewritten/added.

3. Finish

Show the partition list, the generated checklist and the roadkeep commands the audit will use, in 20 lines or less, then stop. Do not run the audit.