Three auditors for the configuration you hand an AI coding agent — skill files, standing instruction files, and the overall shape of a setup — splitting what a computer can check exactly from what genuinely needs judgment.
Code decides, the model only judges
Agent configuration is code nothing compiles: a skill file can tell an agent to pipe untrusted
input into a shell and nothing objects, two instruction files can give opposite orders, a memory
file can assert a fact that stopped being true months ago. agent-audit runs every mechanical
question — does a referenced script exist, how long is a file, does a name field agree with its
directory — in Python, identically on every run. Only the parts that genuinely need a language
model run at all, one scoped question per subprocess, and every model pass must answer inside a
JSON schema; it never decides control flow and never writes a line of the report itself.
Three commands
agent-audit skills .— structural, security, quality, determinism and cross-skill passes over everySKILL.mdand agent definition.agent-audit instructions .— contradictions, an effectiveness score, and context-optimisation advice forCLAUDE.md/AGENTS.md-style files.agent-audit maturity .— classifies each component as STAY, GRADUATE_CODE or GRADUATE_AGENT.
skills manifest and skills diff skip the model entirely — cheap enough to run in CI as a drift
check between two checkouts.
Where a report goes
By default: ./agent-audit-reports/<target-slug>/<date>-<kind>.md, and a second run on the same
day writes -2 rather than overwriting the first — so this week’s findings diff cleanly against
last week’s. --budget-usd caps a runaway pass rather than targeting a spend: a pass that trips it
returns nothing rather than a partial answer.
Requirements
Python 3.11+, standard library only. The model-backed passes shell out to the claude CLI, which
must already be installed and authenticated — agent-audit never reads an API key or opens a
network socket of its own. The deterministic commands (skills manifest, skills diff,
--focus structural) work without it.
Documentation
agent-audit’s documentation lives in its repository, next to the code it describes — the README is the manual.