Results for “audit”

Use this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit programme for the three-year cycle", "who can do our internal audit", "we are too small for an independent auditor", "readiness audit before the examination" or "which areas do we audit first". Ranks audit areas by risk, change and past findings, sets how often each is audited across the cycle, assigns auditors who are independent of what they audit, sizes the effort, and writes a programme, a coverage matrix and a calendar for leadership to approve.

The English summary is being prepared. Showing the original description.

Internal audit support skill aligned with IIA (Institute of Internal Auditors) International Standards. Provides risk-based audit planning, audit program development, workpaper documentation, finding development (Condition/Criteria/Cause/Effect), and Corrective Action Request (CAR) tracking. Use when: planning annual/quarterly audits, creating risk assessment matrices, developing audit programs and test procedures, documenting audit workpapers, writing audit findings and reports, tracking corrective actions and follow-ups, preparing for external audits (SOX, ISO). Triggers: "internal audit", "audit plan", "audit program", "audit workpaper", "audit finding", "risk assessment", "CAR tracking", "corrective action", "IIA Standards", "COSO framework", "監査計画", "監査プログラム", "監査調書", "是正措置", "リスク評価".

The English summary is being prepared. Showing the original description.

Investigate Linux intrusions using auditd records. Configure audit rules, search events with ausearch, summarize activity with aureport, reconstruct a timeline of suspicious actions, and forward logs to a central security monitoring system.

• Investigating unauthorized access or privilege escalation
• Checking changes to critical files and SSH keys
• Reconstructing an incident timeline

Plan ISO 27001 information security audits, review evidence that security controls work, and document findings. The skill also helps classify failures, track corrective actions, and prepare documentation for certification audits.

• Planning an annual internal audit
• Reviewing evidence for Annex A controls
• Documenting findings and corrective actions

Plan and conduct internal audits for medical device quality management systems under ISO 13485. Organize evidence, classify findings, verify corrective and preventive actions, and prepare for external audits with structured checklists and risk-based scheduling.

• Plan an annual internal audit schedule
• Document audit evidence and classify findings
• Verify the effectiveness of corrective actions

Use this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor interviews", "what will the auditor ask our CTO", "interview briefing for the audit", "how should people answer the auditor", "mock audit interviews" or "our engineers are nervous about the audit". Builds a one-page brief per role: what the auditor is likely to ask, the records that person should be able to open, the honest way to answer what they do not know, and a short mock interview, plus an interview schedule with the evidence each session needs.

The English summary is being prepared. Showing the original description.

Compare a saved repository audit with a fresh audit in one command. Receive a structured report showing structural similarity, with an alert and exit code when similarity falls below your chosen threshold.

• Check structural changes after a weekly audit
• Compare the repository with an audit at least seven days old
• Use drift detection results in CI checks

Audit dependency files across eight language ecosystems for built-in vulnerability patterns, license conflicts, and indirect dependency risks. Generate a prioritized upgrade plan with testing and rollback notes, and pair results with live audit tools for current vulnerability coverage.

• Auditing third-party packages before a release
• Checking dependencies against built-in CVE patterns
• Reviewing license conflicts across dependency chains

Prepare for ISO 27001 audits by reviewing six areas of an information security management system: audit coverage, risks, access, suppliers, incidents, and management reviews. Summarize evidence gaps, readiness, and three priority actions with owners and timelines.

• Prepare evidence for an annual internal audit
• Check readiness before certification or surveillance audits
• Review audit scope after business or system changes

Set up WizTelemetry Auditing to collect Kubernetes and KubeSphere audit events, records of system operations. Configure storage and retention, then query events by user, action, resource, response status, or time.

• Deploy audit event collection to selected clusters
• Find operations by user, action, resource, and time
• Configure audit storage and retention

Guides internal privacy audit program design and execution including risk-based audit planning, scope definition, fieldwork procedures, finding classification, evidence gathering, remediation tracking, and management reporting. Covers audit universe definition, annual audit plan, working papers, and closure verification. Keywords: internal audit, privacy audit, fieldwork, remediation, findings, audit plan.

The English summary is being prepared. Showing the original description.

Comprehensive audit of a user's entire Claude environment — combines Project audit (six-dimension Project Scorecard, seven anti-patterns) with Global audit (six-dimension Global Layer Scorecard) plus Cross-Layer Alignment Check across all nine layers and Evolutionary Recommendations across four pathways. Produces a unified action plan. Use when user says "full audit of everything," "audit my entire Claude setup," "full stack audit," "comprehensive review of my project and preferences," "check everything," or wants the complete health check of both a specific Project AND their global configuration. Also use when a project audit reveals cross-layer issues that require full-stack visibility. Do NOT use for auditing only a Project (use rootnode-project-audit if available) or only global layers (use rootnode-global-audit if available). Do NOT use for single prompt evaluation (use rootnode-prompt-validation if available). Run on Opus 5 or Sonnet 5 at `high` effort (both defaults); depth reduces on legacy models.

The English summary is being prepared. Showing the original description.

Flagship comprehensive SEO audit combining Ahrefs and GSC data in sequential waves with checkpoint saves. Use when user says "site audit pro", "full audit", "comprehensive audit", "audit with live data", "deep audit", "pro audit", "complete SEO audit", "run a full site audit", or "audit everything for this domain". Requires domain param. Optional: site param for GSC overlay.

The English summary is being prepared. Showing the original description.

Audit a codebase across nine areas, including architecture, tests, security, and documentation. Produces TECH_DEBT_AUDIT.md with source locations, severity ratings, estimated repair effort, and prioritized recommendations to help plan maintenance work.

• Assessing a codebase before maintenance
• Prioritizing technical debt fixes
• Checking architecture and code consistency

Connect static analysis results and human audit notes to a Trailmark code graph. Group findings by severity and compare them with input flow, impact, and privilege boundaries to prioritize investigation and understand findings in their code context.

• Connecting Semgrep or CodeQL results to code structure
• Combining human audit notes with automated findings
• Prioritizing findings using input flow and impact

Vulnerability audit and dataflow analysis built on the neug CPG engine. file_audit (default, recommended): first builds a function-level summary graph (tier1) over the entire project, then incrementally builds detailed CPGs (tier2) on demand for chosen functions; both tiers coexist in a single neug database (unified schema, cross-layer refines edges; C/Java/Python/Rust). All capabilities are exposed as CLI tool subcommands (audit/overview/build/query/methods/paths), so an agent can drive the audit step by step via shell; the audit subcommand can also run the built-in LLM loop. The same tooling also supports a dataflow analysis mode (Workflow C): no vulnerability hunting, only variable-level dataflow tracing for functions of interest, producing dataflow_analysis.json. repo_audit: multi-round LLM/Cypher audit over a full-repo CPG. Use when the user asks to audit a codebase/project for vulnerabilities, scan a project with CPG/neug, run repo_audit/file_audit, find source-to-sink taint paths, or analyze dataflow inside a function. Supports C, Java, Python, and Rust.

The English summary is being prepared. Showing the original description.

Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incident process against what the policy says". Turns each commitment in the company's policies and procedures into a test with a question, a record to inspect, a sample and a pass criterion, adds framework-specific checks through a lookup, and writes a checklist file the auditor fills in during fieldwork.

The English summary is being prepared. Showing the original description.

Designs an audit document register to track required records, reporting periods, requests, receipt dates, reviewers, queries, and adjustments. Provides recommendations and, on request, empty templates in CSV, SQL, JSON Schema, or Notion mappings.

• Preparing a year-end audit document checklist
• Designing a document request and receipt tracker
• Keeping audit queries and adjustments together

Review an AI Management System against six audit questions covering scope, policy, risks, reassessment, audit independence, and integration with existing management systems. Summarize evidence gaps, readiness, and three prioritized actions with owners and dates.

• Reviewing readiness before a stage 1 certification audit
• Preparing the annual internal audit plan
• Adding an AI system to the management scope

Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge gate on a Python project, post-incident sweep after a PyPI compromise (e.g. ctx, request-toolbelt typosquats, ultralytics 8.3.42 compromise), SOC2 evidence collection, or inheriting an unfamiliar Python codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit python deps", "pip vulnerability scan", "check pypi packages for CVEs", "pip-audit run".

The English summary is being prepared. Showing the original description.

Evidence-first marketing audit of a third-party local business (café, roaster, shop, restaurant, hotel, clinic, home service) from a Google Maps, share.google or website link — located DataForSEO rankings, map packs, search volume and seasonality, listings, reviews, backlinks, AI-assistant answers and a site crawl, plus direct checks (real-browser access, page weight, store shipping quotes, email DNS, mobile screenshots) — delivered as an owner-facing report with priced offers, an exact change list and a 12-week plan, optionally localized and bilingual. Use when "audit this business", "full marketing audit of <business>", "prospect audit", "local business audit", "use DataForSEO for the hard SEO data", "go deeper", "rerun it for local <market>", "also in Spanish", "give me the offers, changes and 3 month plan", or a business link arrives with "audit". For auditing your own product across channels use /kai-audit.

The English summary is being prepared. Showing the original description.

Multi-backend database security auditor. Audits Supabase, Firebase (Firestore/RTDB/Storage/Functions/Remote Config), MongoDB (self-hosted + Atlas), self-hosted PostgreSQL, and self-hosted MySQL for RLS/rules misconfigurations, exposed credentials, auth bypasses, MongoBleed (CVE-2025-14847), pgBouncer CVE-2025-12819, mysql_native_password drift, ghost auth, and storage exposures. Use this skill whenever the user mentions database security, RLS or rule audits, security review, penetration testing a vibe-coded app, checking if their DB is exposed, hardening a backend, fixing security rules, or auditing apps built with Lovable/Bolt/Replit/Cursor/Claude Code on any of these backends. Trigger on phrases like 'is my app secure', 'check my database', 'audit my Firebase', 'audit my MongoDB', 'audit my Postgres', 'audit my Supabase', 'is my DB exposed', or any cross-backend variant ('audit my full stack').

The English summary is being prepared. Showing the original description.

Prepares a DRAFT internal audit pack from the audit plan: scope as stated, criteria with clauses quoted from the documents provided, document requests per auditee with due dates, open interview questions per process and role, previous findings to follow up and a readiness checklist. Never pre-judges conformity, writes findings or selects the sample; the lead auditor decides. Use when the user asks to "prepare the internal audit", "build the audit pack from this plan", "draft the document requests and interview questions" or "get us ready for the supplier audit". Do not use for evidence requests built from a control list, use control-evidence-request-pack instead; to chase actions from earlier audits, use corrective-action-tracker. Drafts for human review; never approves, authorises or signs off.

The English summary is being prepared. Showing the original description.

Run three static audits covering architecture alignment, threats, and MCP server policies, permissions, and dependencies. Store timestamped results, track changes across runs, and fail scheduled CI jobs when findings reach a chosen severity.

• Running weekly architecture and security audits
• Reviewing MCP permissions and dependency findings
• Comparing audit records over time