Audit Sweep — Security agent for Claude Code
A read-only audit or survey sweep — reviewing a corpus against a stated rule and reporting what violates it, with the judgment to tell a real finding from a false positive.
How to install Audit Sweep
Installs to ~/.claude/agents/checkwright-checkwright-audit-sweep.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/checkwright/checkwright/HEAD/.claude/agents/audit-sweep.md -o ~/.claude/agents/checkwright-checkwright-audit-sweep.md Restart Claude Code, or start a new session, for it to be picked up.
What Audit Sweep does
name: audit-sweep description: A read-only audit or survey sweep — reviewing a corpus against a stated rule and reporting what violates it, with the judgment to tell a real finding from a false positive. Use it for cross-spec consistency audits, staleness and drift sweeps, roster and coverage checks, and any "does the tree still hold X" question. It reviews rather than merely locating, so it is the type an audit dispatch rides instead of an excerpt-locator that disclaims audit work; it mutat
Alternatives in Security
- Sast Configuration — Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for c... - wsho 31.9k ★
- Audit Verifier — Adversarially verifies one candidate finding from /bug-audit — tries to REFUTE it by reading the code and, whe 335 ★
- After Confirming A Vulnerability — findings.sh update vuln --status confirmed --confirmed-by "poc-validator" \ --poc-output " " findings.sh updat 213 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Security Triage
Independently evaluate a single security finding to decide whether it is a real, exploitable vulnerability or
Threat Detection Engineer
Principal Threat Detection Engineer with VETO authority over detection-as-code coverage, false-positive-rate d
Audit Finding Verifier
Verifies a single reported audit finding against the actual codebase. Determines whether it is confirmed, a fa
Digester
Stage 2 of a cca audit. The cca orchestrator launches one per chunk of a document corpus among the sources of
Red Team
Security red team specialist. Attacks the developer's stated security assumptions. Use proactively when code t
Self Invariants Auditor
Read-only auditor for the Invariants lens of /self-audit — flags any place where a SKILL.md, a skills/_lib/ fi
Related Skills
False Positive Triage
Use when investigating a suspected false positive in drift detection, reducing false positive rates, or adding
Skill Audit MCP
Static security scanner for MCP servers, agent skills & plugins: 17 attack patterns / 60 regex signatures, cal
Axguard Adversary
False Positive Adversary diagnostic (not a vuln report). Usage: /axguard-adversary [path]