# Audit Software Releases with Evidence

Release decisions often rely on incomplete evidence and inconsistent standards. This skill applies structured controls, deterministic scoring, and mandatory gates to assess readiness.

## Install

```bash
npx skillstore add glenskii/universal-audit
```

## Metadata

- Status: approved
- Slug: glenskii-universal-audit
- Version: 1.0.3
- Author version: 1.0.3
- Skillstore revision: r2
- Version status: valid
- Tree hash: 3911574ab963f262e2e43e305146f606ae177845e11add3d8e88e7fb89142753
- Author: glenskii
- GitHub username: glenskii
- License: MIT
- Repository: https://github.com/glenskii/glenski-plugins/tree/60a0fdb8645aff907f29880bc70b1ee62ec7309c/plugins/glenski-quality-suite/skills/universal-audit
- Ref: f4838806900353c20a6899b1cbb5f5bc3a23357a
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, filesystem, external\_commands
- Quality score: 92
- Quality tier: featured
- Public page: https://skillstore.pages.dev/skills/glenskii-universal-audit
- Manifest: https://skillstore.pages.dev/api/skills/glenskii-universal-audit/manifest

## Capabilities

- Selects audit controls by depth tier, product profile, and documented applicability.
- Guides evidence collection across security, reliability, architecture, quality, privacy, accessibility, operations, and delivery.
- Records control statuses, findings, limitations, and sanitized evidence in defined audit artifacts.
- Calculates weighted category scores, coverage, caps, and mechanical release blockers with a bundled Python scorer.
- Requires independent challenge for standard and deep audits.
- Produces a structured report, risk register, action plan, and release verdict.

## Use Cases

- Prepare a release decision: Assess a candidate release against evidence coverage, quality controls, and mandatory gates before deployment.
- Run a structured security review: Evaluate security and privacy controls while recording authorization, evidence, limitations, and remediation priorities.
- Measure production readiness: Compare engineering quality across architecture, reliability, operations, accessibility, performance, and delivery practices.

## Prompt Templates

### Start a rapid audit

```
Run a rapid audit of this repository. Begin with scope, authorization, product profile, and missing intake information.
```

### Assess release readiness

```
Perform a standard production-readiness audit for this release. Record evidence, limitations, control statuses, scores, coverage, findings, and release gates.
```

### Review a sensitive system

```
Plan a deep audit for this data-sensitive system. Define required access, evidence, controls, authorization boundaries, and independent verification.
```

### Re-audit remediation

```
Re-audit the supplied prior findings against the current build. Verify remediation, regressions, remaining risks, current evidence, and changed scores.
```

## Limitations

- Results depend on the access, authorization, evidence, and environments provided by the operator.
- The scorer cannot evaluate qualitative gates without auditor judgment.
- Active, destructive, load, or authorization testing requires explicit rules of engagement.
- The skill does not replace specialized legal, regulatory, penetration testing, or certification services.

## Best Practices

- Define scope, authorization, environment, depth, and product profile before selecting controls.
- Use affirmative, sanitized evidence and mark unsupported claims as unverified.
- Keep scores separate from mandatory gates and independent review outcomes.

## Anti Patterns

- Do not treat scanner silence or missing evidence as a passed control.
- Do not run active tests outside explicit rules of engagement.
- Do not remove applicable controls to improve coverage or scores.

## Security Audit

- Audited at: 2026-08-09T08:35:02.938\+00:00
- Summary: All 56 static findings are false positives caused by Markdown formatting, JSON Schema identifiers, audit terminology, or expected local artifact output. The reviewed procedures require authorization for active testing, default to passive inspection, and prohibit unsafe or unauthorized actions.

## Stats

- Views: 8
- Downloads: 18
- Favorites: 0
- Popularity score: 0