# Audit Flow

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with...

- Repository: https://github.com/zebbern/claude-code-guide (4691 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add zebbern/claude-code-guide --skill audit-flow -g -a claude-code -y`
Codex: `npx skills add zebbern/claude-code-guide --skill audit-flow -g -a codex -y`
Cursor: `npx skills add zebbern/claude-code-guide --skill audit-flow -g -a cursor -y`
Gemini CLI: `npx skills add zebbern/claude-code-guide --skill audit-flow -g -a gemini-cli -y`

## Description

Interactive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## ⚠️ MANDATORY ENTRY POINT, Execute Before ANY Other Action

**Step 1: Read schema.sql**

```bash
# ALWAYS read the schema first to understand tables, constraints, views
cat .claude/skills/audit-flow/schema.sql
```

**Step 2: Check if DB exists, NEVER recreate**

```bash
# Check for existing database
ls -la .audit/audit.db 2>/dev/null && echo "DB EXISTS - DO NOT RECREATE" || echo "No DB - safe to init"
```

**Step 3: If DB exists, show current state**

```bash
python .claude/skills/audit-flow/scripts/audit.py list
```

### 🚫 FORBIDDEN ACTIONS

| Action                                                | Why Forbidden            |
| ----------------------------------------------------- | ------------------------ |
| `rm .audit/audit.db`                                  | Destroys audit history   |
| `audit.py init` when DB exists                        | Overwrites existing data |
| `DROP TABLE`                                          | Destroys audit history   |
| `sqlite3 .audit/audit.db < schema.sql` when DB exists | Overwrites existing data |

**Rule:** If `.audit/audit.db` exists, ONLY use `audit.py list`, `show`, `export`, or INSERT operations. NEVER recreate.

---

# Audit Flow

Interactive tracing of system flows with SQLite persistence. Supports multiple named flows per session, non-linear flows (branching/merging), and multi-format exports.

## Organization Principles

**Directory structure by purpose:**

- **Audits/Documentation/Compliance:** `docs/audits/{name}-{YYYY-MM-DD}/`
- **Ideation/Brainstorming:** `docs/ideation/{name}-{YYYY-MM-DD}.md` (single file, no subdirectory unless artifacts needed)
- **Debugging/Incident Review:** `docs/audits/{name}-{YYYY-MM-DD}/` (same as audits, captures evidence)
- **Architecture Review:** `docs/audits/{name}-{YYYY-MM-DD}/` (same as audits, captures structural analysis)

**Required files:**

- INDEX.md (manifest, entry point)
- README.md (executive summary)
- {name}-audit.md (flow trace)

The rest: https://github.com/zebbern/claude-code-guide/blob/HEAD/skills/audit-flow/SKILL.md