/audit

name: audit
description: "Check whether what I said in this session is backed by what I actually did — did the tests I reported as passing really run, was an expected value quietly rewritten, was a test switched off. Reads this project's Claude Code transcript and git state locally and reports each gap with the timestamp and the quoted line. Use when the user asks whether the tests really ran, whether a claim holds up, or asks for an audit of this session."
allowed-tools:
  - Bash(npx --yes @jinhyuk9714/red-handed@latest *)
  - Read

Audit this session

Run the audit and report what it found. Nothing here needs to be installed first; `npx` fetches the CLI on demand.

Running it

The most recent session for this directory:

npx --yes @jinhyuk9714/red-handed@latest audit

The subcommand is required. Running the tool bare reports how often "tests pass" had a real run behind it across the whole machine, which is a different question.

Useful variations:

• `--all` — every session recorded for this project, not just the latest
• `--lang ko` — report in Korean (it follows the system locale by default)
• `--git-only` — when there is no transcript, audit the working tree diff instead
• `--json` — when you need to read the findings programmatically rather than quote them

The command exits 1 when something reached the CAUGHT tier and 0 otherwise. A non-zero exit here is the tool working, not an error to retry.

Reporting what it found

Show the tool's own output. It is written to be read by a person: each finding already carries a plain-language description, the evidence with timestamps, and one thing to go check.

Then, briefly:

• If nothing was found, say so plainly. That is the common case and it is not a

disappointment. Do not pad it.

• If something was found, state it without softening and without arguing. When

the finding is about this session, it is about **your own** work — resist the pull to explain it away. The user asked what the record says; the record is what it says.

• `CAUGHT` means the session shows it happening and the change is still in the

working tree. `SUSPICIOUS` means the pattern is there but the motive is not established — an empty catch block is sometimes exactly right.

• If a finding looks wrong to you, say why in one sentence and point the user at

the quoted evidence so they can judge. Do not silently drop it.

What it cannot see

Worth saying out loud when it returns nothing, so a clean result is not mistaken for a guarantee:

• Verification it cannot read counts as verification it did not see. A project's

own test script, a browser check, anything without machine-readable output.

• Claim sentences are matched in English, Korean, Japanese and Chinese. The

report itself is written in English or Korean.

• It says nothing about whether the code is correct. It only reports where the

record does not support the claim.