/audit

name: audit
description: Use when someone asks for an AIOS audit, asks to score their setup against the Four Cs, or says "is my AIOS working" / "audit my setup" / "find gaps in my AIOS". Produces a Four-Cs scoreboard with top-3 fixes ranked by leverage.

What this skill does

Runs the **Four Cs Audit** on the current Claude Code project. Reads (never writes) the project's operating manual, memory, skills, agents, MCPs, decisions, and references. Scores each of the Four Cs out of 25. Surfaces strengths and the top 3 leverage-weighted gaps with concrete next-step commands.

**Scope is structural — "is the AIOS built right?"** It is NOT a capability planner. Capability gaps ("you could build a daily brief if you connected calendar") belong to `/level-up`. The audit answers: are the files, folders, registries, and connections in good shape?

First run is the baseline. Re-run weekly to watch the score climb. That's the compounding hook.

Today's context

• **Date:** !`date +%Y-%m-%d`
• **Project root:** the current working directory

The Four Cs (scored 25 each = 100 total)

| Layer | Test | |---|---| | **Context** | Knows the business — identity, team, voice, decisions, references | | **Connections** | Reaches the user's stuff — MCPs, integrations, data sources | | **Capabilities** | Knows how to do work — skills + agents | | **Cadence** | Runs without being asked — schedules, hooks, recurring rituals |

Execution

Step 1: Discover the project shape

The audit looks for **patterns and intent**, not exact paths. File names vary. Use Glob and Read to check:

**Operating manual:** `CLAUDE.md` (root), `CLAUDE.local.md` (gitignored). **Memory:** `MEMORY.md` (root), `~/.claude/projects/<id>/memory/MEMORY.md`, or `memory/` folder. **Skills:** `.claude/skills/*/SKILL.md` — count + frontmatter. **Agents:** `.claude/agents/*.md` — count + frontmatter. **Connection mechanisms** (any of these = "reachable"):

• MCPs: `.mcp.json`, `.claude/settings.json` (mcpServers key), `.claude/settings.local.json`
• API scripts: `scripts/*.py|.js|.ts` documented in CLAUDE.md
• Export pipelines: `data/`, `imports/`, `exports/` with refresh script + last-run timestamp
• API keys + reference guide: `.env` entries + corresponding `references/{tool}-api.md`

**Connections registry:** `connections.md` (anywhere). **Reference guides:** `references/{tool}-api.md`, `references/*-reference.md`, or equivalent. **Decisions:** `decisions/log.md`, `decisions.md`, or any append-only decisions file. **References / SOPs:** `references/`, `docs/`, `sops/` folders. **Templates:** `templates/`, `.claude/templates/`. **Hooks / scheduled jobs:** `.claude/settings.json` hooks key, or skill names matching `morning-*`, `weekly-*`, `daily-*`, `monthly-*`, `standup`.

Don't penalize for non-canonical names if equivalent intent is captured elsewhere.

Step 2: Score each C (25 points each)

Context (25 pts)

| Criterion | Points | How to detect | |---|---|---| | Operating manual exists and is substantive (>200 words) | 5 | Read CLAUDE.md, count words | | Identity / role / voice captured | 5 | CLAUDE.md mentions who the user is + role/mission, OR `.claude/rules/*.md` exists | | Persistent memory exists with multiple entries | 5 | MEMORY.md exists with >3 entries, OR `memory/` has >3 files | | Reference docs exist | 5 | `references/`, `docs/`, or `sops/` has ≥1 file | | Decisions captured | 5 | `decisions/log.md` or equivalent has ≥1 entry |

Connections (25 pts) — domain-aware, mechanism-agnostic

A "reachable" connection counts via ANY mechanism: MCP, script, export pipeline, or `.env` key + `references/{tool}-api.md`. The kit is API-first; the audit doesn't prefer MCPs.

**The 7 Tier-1 Universal Data Domains:**

| # | Domain | Examples | |---|---|---| | 1 | Revenue / Financials | Stripe, Skool, GoHighLevel, QuickBooks, Looker | | 2 | Customer interactions | HubSpot, Salesforce, Gmail-as-CRM, Skool DMs | | 3 | Calendar | Google Cal, Outlook, Calendly | | 4 | Communication | Gmail, Outlook, Slack, Teams | | 5 | Project / task tracking | ClickUp, Asana, Linear, Notion DB, Jira | | 6 | Meeting intelligence | Granola, Otter, Fireflies, Gong, Zoom | | 7 | Knowledge / files | Notion, Drive, Dropbox, Confluence, SharePoint |

**Tier-2 (bonus):** AI service API keys (OpenRouter, Anthropic, OpenAI), decisions/history, content/publishing.

| Criterion | Points | How to detect | |---|---|---| | Tier-1 domain coverage | 10 | 1.4 pts per tier-1 domain reachable. Round to nearest 0.5. Cap 10. | | Reference guide presence | 5 | -1 per connected tool with no `references/{tool}-api.md`. Floor 0. | | Auth / pipeline freshness | 5 | -1 per connection in `needs-auth`/`expired` state, or script with no run within 30 days. Floor 0. | | Documentation in `connections.md` | 3 | 0 if missing; 1 sparse; 2 most; 3 covers all reachable. | | Read-AND-write balance | 2 | At least one connection can WRITE (send email, post update, etc.). 0 if all read-only — the AIOS is a viewer not an OS. |

Capabilities (25 pts)

| Criterion | Points | How to detect | |---|---|---| | 3+ skills installed | 10 | Count `.claude/skills/*/SKILL.md` | | 1+ user-built skill | 10 | Skill names not in: `onboard`, `audit`, `level-up`, `skill-creator`, `skill-builder`, `decision`, `connect`, `connect-check`, `memory-prune`, `scaffold-skill`, `scaffold-agent`, `draft`, `standup` (canonical AIS-OS + Anthropic shipped skills) | | 1+ agent defined | 5 | Count `.claude/agents/*.md` ≥ 1 |

Cadence (25 pts)

| Criterion | Points | How to detect | |---|---|---| | 1+ recurring/scheduled trigger | 10 | `.claude/settings.json` hooks, OR skill name matches `morning-*` / `daily-*` / `weekly-*` / `monthly-*` / `standup` | | Recent activity / usage signal | 10 | Files in `.claude/skills/` modified within 30 days, OR `decisions/log.md` has entry within 30 days | | Templates folder populated | 5 | `templates/` or `.claude/templates/` has ≥1 file |

Step 3: Identify top