Three auditors for the configuration you hand an AI coding agent — skill files, standing instruction files, and the overall shape of a setup — splitting what a computer can check exactly from what genuinely needs judgment.
Code decides, the model only judges
Agent configuration is code nothing compiles: a skill file can tell an agent to pipe untrusted
input into a shell and nothing objects, two instruction files can give opposite orders, a memory
file can assert a fact that stopped being true months ago. agent-audit runs every mechanical
question — does a referenced script exist, how long is a file, does a name field agree with its
directory — in Python, identically on every run. Only the parts that genuinely need a language
model run at all, one scoped question per subprocess, and every model pass must answer inside a
JSON schema; it never decides control flow and never writes a line of the report itself.
Three commands
agent-audit skills .— structural, security, quality, determinism and cross-skill passes over everySKILL.mdand agent definition.agent-audit instructions .— contradictions, an effectiveness score, and context-optimization advice forCLAUDE.md/AGENTS.md-style files.agent-audit maturity .— classifies each component as STAY, GRADUATE_CODE or GRADUATE_AGENT.
skills manifest and skills diff skip the model entirely — cheap enough to run in CI as a drift
check between two checkouts.
Where a report goes
By default: ./agent-audit-reports/<target-slug>/<date>-<kind>.md, and a second run on the same
day writes -2 rather than overwriting the first — so this week’s findings diff cleanly against
last week’s. --budget-usd caps a runaway pass rather than targeting a spend: a pass that trips it
returns nothing rather than a partial answer.
Requirements
Python 3.11+, standard library only. The model-backed passes shell out to the claude CLI, which
must already be installed and authenticated — agent-audit never reads an API key or opens a
network socket of its own. The deterministic commands (skills manifest, skills diff,
--focus structural) work without it.
The Windows installer above — agent-audit-setup-<version>.exe, on every release — is agent-audit
frozen into one executable, so it needs no Python. It does not bundle the claude CLI, so that
prerequisite still applies. It installs into Program Files and appends that directory to the system
PATH; open a new terminal afterwards, because one already open still holds the old PATH.
Documentation
agent-audit’s documentation lives in its repository, next to the code it describes — the README is the manual.