Code Review Specialist
luongnv89/claude-howto
Reviews code for security, performance, quality and maintainability, using a checklist, a finding template and two metrics scripts.
Scans the working directory for ignored errors, hard-coded secrets, debt comments, dead exports and type gaps, and reports findings by severity without editing files.
Install Read-Only Code Audit
$ npx skills add HarnessMD/munder-difflin --skill md-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install HarnessMD/munder-difflin md-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/HarnessMD/munder-difflin.git skills-src && mkdir -p .claude/skills && cp -r skills-src/resources/skills/md-audit .claude/skills/md-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "md-audit" agent skill from https://github.com/HarnessMD/munder-difflin/tree/main/resources/skills/md-audit into .claude/skills/md-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "md-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/HarnessMD/munder-difflin/tree/main/resources/skills/md-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add HarnessMD/munder-difflin --skill md-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install HarnessMD/munder-difflin md-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/HarnessMD/munder-difflin.git skills-src && mkdir -p .agents/skills && cp -r skills-src/resources/skills/md-audit .agents/skills/md-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "md-audit" agent skill from https://github.com/HarnessMD/munder-difflin/tree/main/resources/skills/md-audit into .agents/skills/md-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "md-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add HarnessMD/munder-difflin --skill md-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install HarnessMD/munder-difflin md-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/HarnessMD/munder-difflin.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/resources/skills/md-audit .cursor/skills/md-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "md-audit" agent skill from https://github.com/HarnessMD/munder-difflin/tree/main/resources/skills/md-audit into .cursor/skills/md-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "md-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/HarnessMD/munder-difflin.git --path resources/skills/md-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add HarnessMD/munder-difflin --skill md-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install HarnessMD/munder-difflin md-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/HarnessMD/munder-difflin.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/resources/skills/md-audit .gemini/skills/md-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "md-audit" agent skill from https://github.com/HarnessMD/munder-difflin/tree/main/resources/skills/md-audit into .gemini/skills/md-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "md-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install HarnessMD/munder-difflin md-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add HarnessMD/munder-difflin --skill md-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/HarnessMD/munder-difflin.git skills-src && mkdir -p .github/skills && cp -r skills-src/resources/skills/md-audit .github/skills/md-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "md-audit" agent skill from https://github.com/HarnessMD/munder-difflin/tree/main/resources/skills/md-audit into .github/skills/md-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "md-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add HarnessMD/munder-difflin --skill md-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install HarnessMD/munder-difflin md-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/HarnessMD/munder-difflin.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/resources/skills/md-audit .opencode/skills/md-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "md-audit" agent skill from https://github.com/HarnessMD/munder-difflin/tree/main/resources/skills/md-audit into .opencode/skills/md-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "md-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
md-audit- GitHub stars
- 8.6k
- Token cost
- ~350 tokens
- SKILL.md length
- 100 words
- Files
- 1
- Skills in repo
- 7
- Repo updated
- First seen
- Licence
- MIT
At a glance
Scans the working directory for ignored errors, hard-coded secrets, debt comments, dead exports and type gaps, and reports findings by severity without editing files.
- Works in 4 steps: Scope — identify the primary language… → Scan — use Grep and Read to look for → Report — output a findings list sorted… → …
- Getting a quick read on the health of an unfamiliar codebase
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Looking for hard-coded secrets or ignored errors before a release
What it does
This skill performs a quick audit of the current project and edits nothing. The agent identifies the main language and entry points from files such as package.json, Cargo.toml, go.mod or pyproject.toml, then uses Grep and Read to search for specific classes of problems.
It looks for unhandled promise rejections and ignored errors, hard-coded keys, tokens or passwords, TODO, FIXME and HACK comments, exports that nothing imports, and obvious type-safety gaps such as unchecked any or missing null guards. Results are listed under Critical, High, Medium and Low headings, and the agent stops after the report without applying any fixes.
When your agent uses it
- Getting a quick read on the health of an unfamiliar codebase
- Looking for hard-coded secrets or ignored errors before a release
- Producing a prioritized findings list without touching the code
Example prompts
- “Audit the code in this repo and tell me what's wrong.”
- “Do a quick audit and list any hard-coded secrets.”
- “Find dead exports and ignored errors, but don't change anything.”
Requirements
- Pre-approved tools (allowed-tools): Read, Bash, Grep
Workflow steps
4 steps, taken from the first numbered list in SKILL.md.
- Scope — identify the primary language and entry points (package.json, Cargo.toml, go.mod, pyproject.toml, or similar).
- Scan — use Grep and Read to look for
- Report — output a findings list sorted by severity (Critical → High → Medium → Low)
- Stop after reporting. Do not apply any fixes.
What it can do on your machine
Read from SKILL.md and the folder at commit 7d38335. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
ReadBashGrep
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Read-Only Code Audit loads about 350 tokens when it runs. Until then it costs about 88 tokens; SKILL.md has 100 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
allowed-tools: Read, Bash, Grep
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from HarnessMD/munder-difflin at commit 7d38335, republished under its MIT licence (© HarnessMD). 100 words, ~350 tokens.
Download SKILL.mdSave it as
.claude/skills/md-audit/SKILL.md (or your agent's skills folder).- name
- md-audit
- description
- Read-only code quality audit — scan the current working directory for common issues (bugs, dead code, security hotspots, missing error handling) and return a prioritised findings report. No files are edited. Use when asked to "audit the code", "quick audit", "find issues", "code scan", or "what's wrong with this codebase". (munder-difflin)
- allowed-tools
- Read, Bash, Grep
- version
- 1.0.0
Code Audit (read-only)
Perform a read-only code quality scan and return a findings report. Do NOT edit any files.
Steps:
- Scope — identify the primary language and entry points (
package.json,Cargo.toml,go.mod,pyproject.toml, or similar). - Scan — use
GrepandReadto look for:- Unhandled promise rejections / ignored errors
- Hard-coded secrets or credentials (keys, tokens, passwords)
TODO/FIXME/HACKcomments that signal known debt- Dead exports (exported symbols with no in-repo import)
- Obvious type-safety gaps (unchecked
any, missing null guards)
- Report — output a findings list sorted by severity (Critical → High → Medium → Low):
## Audit Report — <project name> ### Critical - [file:line] <description> ### High - ... ### Summary <total count> findings across <file count> files scanned. - Stop after reporting. Do not apply any fixes.
© HarnessMD, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in resources/skills/md-audit of HarnessMD/munder-difflin.
Open the folder on GitHubat commit 7d38335
Compare with similar skills
Read-Only Code Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Read-Only Code Audit this skillHarnessMD/munder-difflin | 8.6k | — | ~350 | Automated safety check: Notes | MIT | |
| Code Review Specialistluongnv89/claude-howto | 42k | — | ~764 | Automated safety check: Pass | MIT | |
| Best Practicesmidudev/100cosas.dev | 114 | 3 repos | ~3k | Automated safety check: Pass | MIT | |
| Codebase Review SwarmZaxbyHub/opencode-swarm | 490 | — | ~2.8k | Automated safety check: Pass | MIT | |
| Find Bugsgetsentry/skills | 1k | 9 repos | ~708 | Automated safety check: Pass | Apache-2.0 | |
| Code Review with Beads Tasksmaslennikov-ig/claude-code-orchestrator-kit | 260 | — | ~2k | Automated safety check: Pass | Custom licence |
Similar skills
Best Practices
midudev/100cosas.dev
Apply modern web development best practices for security, compatibility, and code quality.
Codebase Review Swarm
ZaxbyHub/opencode-swarm
Runs an evidence-gated, quote-grounded audit of a codebase for security, QA, accessibility, performance and more, and writes a verified report without changing source files.
- Official
Find Bugs
getsentry/skills
Find bugs, security vulnerabilities, and code quality issues in local branch changes.
Code Review with Beads Tasks
maslennikov-ig/claude-code-orchestrator-kit
Reviews staged changes, a branch, a PR or a path for bugs, security gaps and performance issues, then writes an evidence-based report and creates Beads tasks.
Review
Thank-you-Linus/Linus-Dashboard
Review code quality, security, and maintainability before committing.
More from HarnessMD/munder-difflin
Temporal Date Window Resolver
HarnessMD/munder-difflin
Resolves a named time window like lastWeek, last30Days or lastQuarter into exact ISO start and end dates relative to the current moment, with no files written and no network calls.
Worker Capability Catalog
HarnessMD/munder-difflin
Read-only catalog that tells a spawned worker agent its environment variables, temporal date-range skills and how to call each integration.
Munder Difflin Hive Sync
HarnessMD/munder-difflin
Runs the start-of-task routine for an agent working in a multi-agent hive: reads memory.md, processes new inbox messages and reminds the agent to record durable facts before ending.
Today Date Resolver
HarnessMD/munder-difflin
Resolve "today" to a concrete ISO date range relative to your run time — today. Returns inclusive civil dates plus exact UTC instants so you have temporal…
Yesterday Date Resolver
HarnessMD/munder-difflin
Resolve "yesterday" to a concrete ISO date range relative to your run time — yesterday. Returns inclusive civil dates plus exact UTC instants so you have…
Md Fetch Summarize
HarnessMD/munder-difflin
Fetch a URL and return a concise markdown summary of its content.
Related
Categories
Questions about Read-Only Code Audit
What does Read-Only Code Audit do?
Scans the working directory for ignored errors, hard-coded secrets, debt comments, dead exports and type gaps, and reports findings by severity without editing files. This skill performs a quick audit of the current project and edits nothing.toml, then uses Grep and Read to search for specific classes of problems.
When should I use Read-Only Code Audit?
Read-Only Code Audit fits situations like: getting a quick read on the health of an unfamiliar codebase; looking for hard-coded secrets or ignored errors before a release; producing a prioritized findings list without touching the code.
How do I install Read-Only Code Audit in Claude Code?
Run `npx skills add HarnessMD/munder-difflin --skill md-audit -a claude-code`. Or copy the skill folder (resources/skills/md-audit in HarnessMD/munder-difflin) into .claude/skills/md-audit in your project. Claude Code loads it when a task matches its description.
How do I install Read-Only Code Audit in Codex?
Run `npx skills add HarnessMD/munder-difflin --skill md-audit -a codex`. Or copy the skill folder (resources/skills/md-audit in HarnessMD/munder-difflin) into .agents/skills/md-audit in your project. Codex loads it when a task matches its description.
Can I use Read-Only Code Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add HarnessMD/munder-difflin --skill md-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/md-audit, .gemini/skills/md-audit, .github/skills/md-audit and .opencode/skills/md-audit in your project.
What does Read-Only Code Audit need to run?
SKILL.md names no scripts, command-line tools or credentials: Read-Only Code Audit is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Bash, Grep.
Does Read-Only Code Audit access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Read-Only Code Audit safe to install?
Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Read-Only Code Audit use?
Read-Only Code Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Read-Only Code Audit use?
About 350 tokens (SKILL.md is roughly 1.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Read-Only Code Audit?
Skills that share tags, products or a category with Read-Only Code Audit: Code Review Specialist (luongnv89/claude-howto, 42k stars), Best Practices (midudev/100cosas.dev, 114 stars), Codebase Review Swarm (ZaxbyHub/opencode-swarm, 490 stars) and Find Bugs (getsentry/skills, 1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Read-Only Code Audit?
HarnessMD (a GitHub organization) maintains it in HarnessMD/munder-difflin, which has 8,567 GitHub stars. The repository holds 7 skills in this directory. The repository was last updated on October 8, 2026.
Source: HarnessMD/munder-difflin on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.