reg-audit

Use when building or changing a regulated system in finance, healthcare or government that must show who did what, when and why, or when the work involves…

Skill by Srimukh99

IndexedMIT

Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/srimukh99-reg-audit

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Use when building or changing a regulated system in finance, healthcare or government that must show who did what, when and why, or when the work involves SOX, HIPAA audit controls, SOC 2 or change control.

Use cases: security, finance

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/reg-audit

What's inside

Skill name: reg-audit
Description: Use when building or changing a regulated system in finance, healthcare or government that must show who did what, when and why, or when the work involves SOX, HIPAA audit controls, SOC 2 or change control.
License: MIT
Instructions: 38 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# reg-audit

This is not legal advice; retention periods and controls come from your compliance team.

## Audit event

Every security- or compliance-relevant action emits one event:

| Field | Notes |
| --- | --- |
| `actor` | User or service identity, never a shared account |
| `action` | Verb from a fixed list (read, create, update, delete, export, grant, login) |
| `resource` | Type and ID, never the sensitive contents |
| `before` / `after` | Changed fields, or a hash when values are regulated |
| `timestamp` | UTC, from a synchronized clock |
| `request_id` | Correlates with traces and logs |
| `source` | IP or service, user agent |
| `reason` | Ticket or justification for privileged actions |

## Storage

1. Append-only and tamper-evident: write-once storage (object lock) or a hash chain.
2. Separate permissions: application admins cannot edit or delete audit records.
3. No secrets, raw PHI or card numbers in events; reference IDs instead.
4. Retention follows written policy (6–7 years is common in finance and healthcare; confirm yours).
5. Searchable for investigations and exportable for auditors.

## Change control

- Every production change links to a ticket and is approved by someone other than the author (segregation of duties).
- Deploys record who, what version, when, and the approval.
- Emergency changes are allowed but reviewed after the fact.

## Tests

Assert that each sensitive action emits exactly one correct audit event, and that audit writes failing makes the action fail rather than proceed silently.

From Srimukh99/rubric, MIT.

Signals

Stars: 0
Forks: 0
Open issues: 0
Last commit (this folder): Oct 2, 2026 (26 days ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/Srimukh99/rubric
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from Srimukh99

Cite this page

reg-audit skill. Agent Mart. https://agentmart.dev/skills/srimukh99-reg-audit (last updated 2026-10-24)