audit-flow

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/audit-flow/SKILL.md

Quality

Content

52%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, safety-conscious workflow skill with strong validation checkpoints, but it is materially undermined by a bundle mismatch: four referenced files (including the runtime-required `schema.sql`) are missing, and the primary Quick Reference command table lists slash-commands that the bundled CLI does not implement. These gaps pull actionability and progressive disclosure down despite otherwise dense, actionable content.

Suggestions

Ship the missing bundle files referenced in the Files section — at minimum `schema.sql` (which `audit.py init` reads from disk, so the skill is currently broken at runtime) — or remove the references and inline the schema/commands/examples.

Reconcile the Quick Reference table with the actual CLI: either implement `add`/`flow`/`link`/`finding` subcommands in `audit.py`, or replace the slash-command table with the real `audit.py` + raw-SQL-INSERT flow the body already documents.

Collapse the repeated 'never destroy/recreate the DB' guidance into a single authoritative safety section to remove the four-way redundancy.

Dimension	Reasoning	Score
Conciseness	The body is dense and reference-style with no concept-explanation fluff, but the 'NEVER destroy/recreate the DB' invariant is repeated across four separate sections (FORBIDDEN ACTIONS table, DB-First CRITICAL block, Constraints table, and the closing Rule line), which is trimmable redundancy.	3 / 5
Actionability	There is substantial executable SQL and CLI guidance, but the mandatory Step 1 entry point (`cat .../schema.sql`) and `audit.py init` cannot run because `schema.sql` is absent from the bundle, and the headline Quick Reference slash-commands (`/audit-flow add`, `link`, `finding`) are not backed by any `audit.py` subcommand.	3 / 5
Workflow Clarity	The interactive workflow is clearly sequenced (session start → granularity → trace → export) with explicit validation checkpoints — `audit.py validate` before export and a checkpoint every 5 tuples — so the destructive-operation cap-at-3 does not apply; the only gap is the broken first step referencing a missing file.	4 / 5
Progressive Disclosure	The Files section signals one-level-deep references to `COMMANDS.md`, `EXAMPLES.md`, `schema.sql`, and `.gitattributes`, but none of these exist in the bundle (only `scripts/audit.py` is present), so the signaled navigation targets are broken and the detail they promise is neither inline nor reachable.	2 / 5
	Total	12 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that pairs concrete capabilities with an explicit 'Use for' clause and a comprehensive 'Triggers on' list, cleanly answering both what the skill does and when to invoke it. The only soft spot is a couple of overly broad triggers (brainstorm, ideation) that mildly raise conflict risk.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete capabilities — 'flow tracing across CODE, API, AUTH, DATA, NETWORK layers', 'SQLite persistence', 'Mermaid export' — but stops short of enumerating the full action set the skill supports.	4 / 5
Completeness	It explicitly answers both 'what' (layered flow tracing with SQLite + Mermaid export) and 'when' via a concrete 'Use for ...' clause plus a dedicated 'Triggers on ...' list, matching the anchor for clearly answering both.	5 / 5
Trigger Term Quality	The explicit 'Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review' clause gives comprehensive coverage of natural phrases a user would actually say, including synonym variants.	5 / 5
Distinctiveness Conflict Risk	The layered flow-tracing-with-SQLite niche is mostly distinct with specific triggers, but broad triggers like 'brainstorm' and 'feature ideation' create minor overlap risk with general ideation skills, keeping it just below a 5.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 3 missing	Warning

	Total	15 / 16 Passed

Repository: zebbern/claude-code-guide
Path: skills/audit-flow/SKILL.md
Commit: 59c5fc4

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.