# Ponytail Repo Audit (ponytail-audit)

> One-shot quality audit of a whole repo for bugs, security holes, load problems, untested risky code, slow paths and code to delete, merge or split.

- Category: [Security Audit](https://www.myskills.tools/en/categories/security-audit/)
- Source: Community · DietrichGebert
- Repository: https://github.com/DietrichGebert/ponytail/tree/main/skills/ponytail-audit (commit 2a1fe84)
- SKILL.md: https://github.com/DietrichGebert/ponytail/blob/main/skills/ponytail-audit/SKILL.md
- Install command: `npx skills add DietrichGebert/ponytail --skill ponytail-audit`
- License: MIT
- Compatible with: Claude Code, Codex, Cursor
- Permissions: read-repo ✓, write-files ✗, shell ✗, network ✗
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.

## Core rule

Every finding needs a concrete case showing the wrong result it causes; no case, no finding.

## Execution Phases

1. **Map first** — Read the README, deploy and build config, dependencies, entry points and tests, find the expected load, and trace the main flows end to end.
2. **Look for problems** — Check for bugs, security and data-loss risks, scale problems, missing tests, speed, and code to delete, merge or split.
3. **Check before reporting** — Before calling code unused, search the whole tree including tests and config; propose only the smallest fix and prefer deletions.
4. **Report ranked findings** — State what the repo does and the assumed load, list up to 20 numbered findings by must, should and nice to fix, and name what was not checked.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Not required | A one-shot report that changes no code. |
| Command execution | Not required | No command execution is described; it only reads and searches code. |
| Network outbound | Not required | The instructions include no network access. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: ponytail-audit
description: >
  Quality audit of a whole repo: bugs, security holes, what breaks under real
  load, risky code without tests, slow paths, and what to delete, merge or
  split. Ranked, each finding explained in plain English. One-shot report,
  changes nothing. Use for "audit this codebase", "review the whole repo",
  "find bloat", "what can I delete", /ponytail-audit.
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/ponytail-audit/