Audit Comments
Use when auditing comments, docstrings, or embedded documentation prose in a scope — to strip bloat and rewrite cluttered-but-justified entries. Triggers on "audit comments", "clean up docstrings", "strip stale comments", "comment cleanup".
Install
$ agentstack add skill-jhostalek-dotclaude-audit-comments ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-jhostalek-dotclaude-audit-comments) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
!cat ~/.claude/skills/audit-workflow.md
Run as the comments dimension. Comments run last because structure, patterns, and correctness edits change what the code does — a comment accurate before those passes may be stale after them. Lens:
Strip comments that don't earn their place; rewrite those that do but bury the signal. Type annotations are primary documentation — every comment competes against the signature, body, and adjacent declarations. Survive only by carrying a WHY sourced from outside the codebase: cited bug, spec, third-party quirk, business rule, historical decision. Behavioral narration ("idempotent", "no-op when empty", "callers rely on X") → strip regardless of accuracy; the code is the source. Named symbols must resolve — a comment referencing a function or constant that no longer exists is wrong, not outdated. Missing comment beats a wrong one — when torn, strip. Skip user-facing strings, log templates, generated code.
Judgment anchor — the keep/strip line:
# retry uses exponential backoff per RFC 6585 §4→ keep (external spec, behavior not visible from code)# returns True if condition holds→ strip (behavioral narration; return type + body say it)# see PaymentService.charge()→ keep only if that symbol exists and the cross-reference is non-obvious; strip if it's just the obvious call site
Strip/rewrite = auto-fix (prose only, code unchanged). Nothing here is sign-off.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: JHostalek
- Source: JHostalek/dotclaude
- License: CC0-1.0
- Homepage: https://jhostalek.github.io/dotclaude/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.