What does the OIA Audit skill do?

The OIA Audit skill runs a composite audit by executing three commands: OIA manifest, threat model, and MCP scan, and stores the results in a timestamped record.

How does the skill handle missing components?

If all components report as unavailable, the skill exits gracefully. If only some components are degraded, it still runs and logs available data with a degradation flag.

Can I schedule audits with this skill?

Yes, the OIA Audit skill is designed for cron integration, allowing you to automate audits on a regular schedule.

What happens if a high-severity issue is detected?

If a high-severity finding is detected, the skill will exit with a non-zero status, indicating a failure to allow for immediate attention.

Where are the audit records stored?

Audit records are stored in the `metaharness-audit` memory namespace, allowing you to retrieve and compare past audits.

OIA Audit

Name: OIA Audit
Availability: InStock
Author: ruvnet

Free

Streamline your composite phase audits with ease.

by ruvnet67.6k stars on ruvnet/ruflo

2 views

Updated Aug 10, 2026

Get this skill

Free · Opens the source repo

What OIA Audit does

The OIA Audit skill is designed to facilitate comprehensive auditing of Open Infrastructure Architecture layers by integrating three essential components: the OIA manifest, threat model, and MCP scan. This skill operates as a composite Phase-2 audit worker, generating a timestamped audit record that is stored in the metaharness-audit memory namespace. By running these components in a single execution, it allows for efficient drift detection over time, making it easier for developers and security teams to monitor and respond to changes in their infrastructure.

At its core, the OIA Audit skill executes three key commands: harness oia-manifest, harness threat-model, and harness mcp-scan. Each command assesses different aspects of the infrastructure, from alignment with architectural standards to identifying potential threats and policy violations. The skill computes a composite worst-severity signal based on the outputs of these commands, enabling users to quickly understand the most critical issues present in their environment.

This skill is particularly useful for teams that require regular audits to ensure compliance and security. It is designed to be integrated into CI/CD pipelines via cron jobs, allowing for automated audits on a scheduled basis. The ability to alert on high-severity findings ensures that critical issues are addressed promptly, while still logging lower-severity issues for future reference. Additionally, the skill gracefully handles cases where one or more components may be unavailable, ensuring that auditing can continue with the available data.

Overall, the OIA Audit skill is an essential tool for any organization looking to maintain a secure and compliant infrastructure. By providing a clear and structured approach to auditing, it helps teams stay informed about their environment's status and facilitates proactive management of potential risks.

When to use it

Use this skill when you need to perform regular audits of your infrastructure to detect drift and assess security risks.

When not to use it

This skill may not be suitable for environments that do not require regular auditing or where the individual components are not applicable.

What you can build with it

Automated Weekly Audits

Set up the OIA Audit skill to run every Sunday at 04:17 UTC, ensuring your infrastructure is regularly checked for compliance.

Drift Detection

Use the skill to compare two audit records and identify any drift in your infrastructure over time.

Security Compliance Checks

Integrate the skill into your CI/CD pipeline to ensure that any high-severity issues are flagged before deployment.

How to install OIA Audit

View source

1. Install with the skills CLI

npx skills add ruvnet/ruflo/harness-oia-audit --agent claude-code

2. Or install it manually

Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.

Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs

Inside SKILL.md

Written by ruvnet

The 13th worker (ADR-150 Phase 2) — runs three MetaHarness static surfaces in one shot, computes a composite worst-severity signal, and persists the audit record to memory so drift over time is visible.

Algorithm

Implementation: scripts/oia-audit.mjs.

Run harness oia-manifest <path> — Open Infrastructure Architecture layer alignment (L1-L9).
Run harness threat-model <path> — categorized MCP-surface threat report with worst: clean|low|medium|high.
Run harness mcp-scan <path> — per-server/tool policy + permissions
- dep findings.
Composite worst = max(threatModel.worst, max(mcpScan.findings.severity)).
Persist payload to memory namespace metaharness-audit with key audit-<iso-timestamp> (unless --dry-run).
--alert-on-worst <severity>: exit 1 if composite worst ≥ threshold.

Graceful degradation

When ALL three components report metaharness-not-available, the script emits the standard degraded payload and exits 0. When only some are degraded, each individual component carries its own degraded: true flag in the audit record — the audit still runs and persists what it could gather.

CI / cron integration

Designed for weekly cron in .github/workflows/:

on:
  schedule:
    - cron: '17 4 * * 0'  # Sundays at 04:17 UTC
jobs:
  oia-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: node plugins/ruflo-metaharness/scripts/oia-audit.mjs --alert-on-worst high

--alert-on-worst high fails the job on any HIGH-severity finding; drift below HIGH is logged but doesn't block.

Memory namespace

Each audit run stores under metaharness-audit:audit-<iso-ts>. To list recent audits:

npx @claude-flow/cli@latest memory list --namespace metaharness-audit --limit 10

To diff two audits (drift detection):

A=$(npx ... memory retrieve --key audit-2026-06-01... --namespace metaharness-audit)
B=$(npx ... memory retrieve --key audit-2026-06-15... --namespace metaharness-audit)
# Compare composite.worst, components.threatModel.worst, etc.

A future ADR can wire this into a dedicated cost-diff-style diff viewer specifically for audit drift.

Pairs with

harness-threat-model — the underlying threat-model component
harness-mcp-scan — the underlying MCP-scan component
harness-score + harness-genome — readiness metrics (orthogonal to audit)

Frequently asked questions about OIA Audit

Similar skills

Microsoft Threat Modeling Tool Generator

Easily create .tm7 files for threat modeling.

Threat Model Analyst

Perform comprehensive threat modeling and analysis.

Modeling Threats with OpenCTI

Centralize and visualize cyber threat intelligence effectively.

Zero Trust DNS with NextDNS

Secure your DNS queries with encrypted protection and threat blocking.

STIX/TAXII Feed Integration

Integrate STIX/TAXII threat intelligence feeds seamlessly.

Attack Path Analysis with XM Cyber

Identify and prioritize vulnerabilities in your security landscape.