Menu
Use when running a criteria-based review (health check, security audit, accessibility review, pen test, bug bash, spec compliance). Creates an Audit document with findings and presents them to the user for triage.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when carrying out the work a delivery document describes -- the build loop -- against its task breakdown and acceptance criteria.
Use as the entry point for any work, including reported bugs, defects, and unexpected behaviour. Reads the configured DAG and the user's position, then dispatches the right verb -- advancing within the current document automatically but stopping at type boundaries.
Use when moving a document to its next status along the type's lifecycle DAG, maintaining links and checking gates at the transition.
Use when drafting a document of a configured type collaboratively -- AI proposes a draft body, the human edits, iterate -- up to the type's authorship ceiling.
Use when adding a new custom document type to a lazyspec project. Interviews the user to co-author the type's methodology -- intent, authorship, lifecycle, gates, relations -- then writes its enriched template and `[[types]]` config via the config-write CLI. One type per run.
Use when running a criteria-based review (health check, security audit, accessibility review, pen test, bug bash, spec compliance). Creates an Audit document with findings and presents them to the user for triage.
| name | create-audit |
| description | Use when running a criteria-based review (health check, security audit, accessibility review, pen test, bug bash, spec compliance). Creates an Audit document with findings and presents them to the user for triage. |
AUDITS DOCUMENT FINDINGS. THEY DON'T FIX THEM.
Present findings to the user. Let them decide what to act on.
Do NOT create plans from findings. The audit produces a findings report that the user triages. Only after the user selects findings to act on should `/create-plan` be used, and that is a separate skill invocation.- Do NOT create plans from audit findings. Present findings to the user for triage. - Do NOT fix issues found during the audit. Document them only.[!IMPORTANT] Read
_common.mdin the skills directory for CLI usage, forbidden actions, and subagent tiers.
Audits sit outside the main pipeline. They feed findings into the pipeline via user triage.
create-audit -> findings -> user triage -> create-plan
create-audit.style.fill: "#4A9EFF"
create-audit.style.font-color: "#FFFFFF"
findings.style.opacity: 0.4
user triage.style.opacity: 0.4
create-plan.style.opacity: 0.4
Define scope and criteria -> Create audit doc -> Review codebase -> Document findings -> Validate -> Present to user
Present to user -> User triages findings -> Use /create-plan skill: for selected findings
Present to user.shape: diamond
Use /create-plan skill.shape: double_circle
lazyspec search "<topic>" --jsonlazyspec show <spec-id> --json| Operation | Agent Type | Tier | Context to provide |
|---|---|---|---|
| Discover relevant code | Explore | Medium | Audit scope, criteria, file paths |
| Review code against criteria | Explore | Medium | Specific criterion, file paths to check |
Define scope and criteria: Work with the user to establish what is being audited and the criteria to audit against. This could be a checklist, a set of standards, or specific spec contracts.
Create the audit: Run lazyspec help create to confirm usage, then: lazyspec create audit "<title>" --author <name>
Link to related documents: If auditing against existing specs or RFCs, run lazyspec help link to confirm usage, then: lazyspec link <audit-path> related-to <target-path>. Link to every document the audit references.
Review the codebase: Use Explore subagents to discover and review code against the criteria. Dispatch one subagent per area of the codebase or per criterion, depending on audit scope.
Document findings: Edit the audit document. Each finding must include:
Validate: Run lazyspec validate --json to ensure all links resolve.
Present to user: Show the complete findings to the user, grouped by severity. Do NOT create plans. The user decides which findings to act on and when.
| Red Flag | Reality |
|---|---|
| "I'll fix this while I'm in here" | Audits document. They don't fix. |
| "This finding is obvious, I'll skip documenting it" | If it's worth noticing, it's worth recording. |
| "I'll create a plan for the critical findings" | The user triages findings. Not you. |
| "I don't need to link to the specs I'm auditing" | Link to everything the audit references. Traceability matters. |
Before claiming this skill is complete:
lazyspec validate --json passes