Skill

audit-orchestrator

Orchestrates full SDLC audit across all phases. Use when running /audit:full or coordinating multiple audit phases. Manages depth control, scope, output artifacts, and final reporting.

Invocation

How this skill is triggered — by the user, by Claude, or both

Slash command

/sdlc-audit:audit-orchestrator

User invocable

Model invocable

Inline context

Default effort

Context Preview

The summary Claude sees in its skill listing — used to decide when to auto-load this skill

SKILL.md

227 lines · ~2k tokens

Stats

LanguageShell

Parent stars0

MaintenanceGood

Last CommitMay 5, 2026

Actions

View Source View Plugin View on GitHub View README

Stats

Actions

Methodology checklist (for ai-scrum integration)

When ai-scrum plugin is installed, this skill triggers sprint cycle. Below structure is parsed by ai-scrum's methodology-parser to generate sprint backlog.

Phase 1: Setup & Discovery

name: Detect project root and language stack mandatory: yes can_skip_if: never success_criteria: language-detection.json saved with at least one language detected effort: XS
name: Read existing audit configuration mandatory: no can_skip_if: no audit.config.yaml exists success_criteria: thresholds and exclusions loaded if config exists effort: XS

Phase 2: Architecture audit

name: Architecture audit (apply architecture-audit skill) mandatory: yes can_skip_if: never success_criteria: architecture/findings.json valid against schema effort: M

Phase 3: Domain audit

name: Domain logic audit (apply domain-audit skill) mandatory: yes can_skip_if: never success_criteria: domain/findings.json valid against schema effort: M

Phase 4: Code quality audit

name: Code quality audit with SAST tools mandatory: yes can_skip_if: depth=quick (skip SAST tools, use Claude reading only) success_criteria: code/findings.json valid, hot files identified effort: L

Phase 5: Test audit

name: Test audit (coverage, quality, pyramid) mandatory: yes can_skip_if: never success_criteria: tests/findings.json valid, coverage gaps identified effort: M

Phase 6: Security audit

name: Security audit (SAST, secrets, CVEs, OWASP) mandatory: yes can_skip_if: never success_criteria: security/findings.json valid, secrets scan complete effort: M

Phase 7: Docs audit

name: Documentation drift detection mandatory: yes can_skip_if: never success_criteria: docs/findings.json valid, drift report generated effort: S

Phase 8: Deploy audit

name: Deployment configuration audit mandatory: yes can_skip_if: project has no CI/CD or deployment config success_criteria: deploy/findings.json valid effort: S

Phase 9: Aggregation & Reporting

name: Findings classification and deduplication mandatory: yes can_skip_if: never success_criteria: _findings-classified.json exists with all findings effort: S
name: Backlog generation with priorities mandatory: yes can_skip_if: never success_criteria: BACKLOG.md generated with sorted findings and fix prompts effort: S
name: Final report generation mandatory: yes can_skip_if: never success_criteria: INDEX.md, EXECUTIVE_SUMMARY.md, METRICS.md all present effort: XS