Pre-Release Audit:check for code and AI skills

Stop finding release bugs after your users do.

Pre-Release Audit checks your project right before you ship and gives one clear verdict: GO, GO WITH WARNINGS, or NO-GO. Every problem comes with a file location and a concrete fix.

Just tell your agent: “Is this ready to release?”, “Audit before I tag v2.1”, or “Check my skill before I publish it.”

Two modes, one skill

Code Release mode first detects what your project is, then runs only the checks that apply:

Detects: Node and web frameworks, Python, Go, Rust, Java/Kotlin, .NET, PHP, Ruby, Android/APK, Flutter, React Native, iOS, Docker, desktop EXE apps (Electron, Tauri, PyInstaller), static sites, and monorepos (each package audited separately).
Checks: git state, version and changelog, committed secrets and keystores, debug leftovers, lockfiles and dependencies, tests and build, destructive migrations, missing environment variables, Docker and CI config, Android release settings, desktop installer settings.
If it can’t identify the type, it says “Type not detected” and runs only the generic checks instead of guessing.

AI Skill Audit mode checks a SKILL.md package before you publish it:

Package structure: the zip layout, missing files, and junk files.
Frontmatter: invalid keys and name rules.
Description quality: whether it will actually trigger.
Body quality: contradictions and instruction clarity.
Safety and honesty rules: no invented data, no guarantees, no credential requests.
Secrets and personal paths: leaked keys, emails, and local paths.
License and copyright line.
Version consistency and claims versus what the skill really does.
Test evidence: whether tests were run in a real client.
What you get

A short report: verdict first, then blockers (with fixes), warnings, a pass/fail table, what could not be checked, and a rollback note.

Built to be safe
Read-only. It never edits files, commits, tags, pushes, or deploys.
Never prints your secrets. It shows only the location and a redacted preview.
Honest. If it can’t verify something, it says SKIPPED or MANUAL, never a false PASS.
No installs. It uses the test and build commands your project already has.
Good for

Solo developers, small teams, indie app makers, and anyone publishing skills or tools to a marketplace without a dedicated release engineer.

Not for

It doesn’t replace a full security audit or penetration test, and it can’t run your tests in your real client for you. It’s a fast pre-ship safety check.