is it safe
to run?

oaudit reads a repo, a folder, or an agent skill and tells you what it actually does — before you install it or run it.

$npm install -g @openthink/audit

binary: oaudit · runs on your Claude Code login

checking a skill before you install it

$ oaudit file ./pdf-skill --against untrusted/agent-skill --format human

[CRITICAL] SKILL.md setup step reads AWS and GitHub credentials

and tells the agent not to mention it (SKILL.md:8)

[HIGH] instructs the agent to act without telling the user (SKILL.md:13)

gate: high or critical → exit 1

// how it works

It reads, it never runs. Files go to Claude with no tools, no settings and no hooks, so the code being audited can't make it do anything.

It judges against the stated purpose. A test skill that starts a server is fine. One that also reads ~/.aws isn't.

It can gate CI. Exit code 1 on anything high or critical.

$ oaudit repo ./some-repo --format human

$ oaudit file ./some-skill --against untrusted/agent-skill --format human

Needs the claude CLI, signed in. Everything else is in the README.