Ponytail Audit

Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.

181,225 stars 9,958 forksSecurity Plugin marketplace

Install

Claude Code plugin

/plugin marketplace add DietrichGebert/ponytail

The repo is a Claude Code plugin marketplace. Run /plugin afterwards to pick the plugin that includes this skill.

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add DietrichGebert/ponytail --skill ponytail-audit

Manual install

git clone --depth 1 https://github.com/DietrichGebert/ponytail.git /tmp/ponytail
mkdir -p ~/.claude/skills
cp -r /tmp/ponytail/.openclaw/skills/ponytail-audit ~/.claude/skills/ponytail-audit

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

Audit the whole repo like the senior developer who just inherited it and
will be paged when it breaks. Order of importance: correct, safe, holds under
load, tested, fast, lean. Lean still matters: every extra line must be read,
tested and fixed later. This is a report the user asked for, so give it in full.

## 1. Map first

- Audit what the user names: a folder, a package, or the whole repo.
  Nothing named: the whole repo.
- Read the README, the deploy and build config, the dependency list, the
  entry points (main, routes, handlers, jobs, CLI commands) and the tests.
- Find the expected load: one person running a script, or many users and
  processes at once. Judge scale against that, and say which load you assumed.
- Trace the main flows end to end: where data comes in, what is stored,
  what goes out. Read those paths fully: input from users, money, auth,
  data writes, background jobs, anything shared between processes.
- Big repo: go deep where a mistake costs the most, not file by file. Say
  which parts you did not read.

## 2. Look for

1. **Bug:** wrong result, crash, missed edge case (empty, zero, last item,
   rounding, time zones), callers that disagree with what a function returns,
   the same rule applied differently in two places.
2. **Risk:** security holes (injection, weak randomness, secrets in code,
   missing checks on input from users), data loss (errors swallowed, writes
   in the wrong order, no transaction).

Read the full skill on GitHub

Details

Skill name: ponytail-audit
Repository: DietrichGebert/ponytail
Path: .openclaw/skills/ponytail-audit/SKILL.md
License: MIT
Repo updated: 29 October 2026

FAQ

What does the Ponytail Audit skill do?

Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most important first.

How do I install the Ponytail Audit skill?

Claude Code plugin: /plugin marketplace add DietrichGebert/ponytail. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Ponytail Audit popular?

It lives in DietrichGebert/ponytail, which has 181,225 GitHub stars and 9,958 forks.

Related skills

Ponytail

181k

DietrichGebert/ponytail

Lazy senior dev mode for any coding task: the smallest change that fully solves it, and a reply a busy human understands in one read.

Productivity & Notes10k

Ponytail

181k

DietrichGebert/ponytail

Lazy senior dev mode: the smallest change that fully solves the task, and a reply a busy human understands in one read. Use on any coding task (writing, fixing, refactoring, reviewing, choosing dependencies) and when the user says "ponytail", "be lazy", "simplest solution", "yagni", or complains about over-engineering or bloat. Levels: lite, full (default), ultra.

Productivity & Notes10k

Ponytail Audit

181k

DietrichGebert/ponytail

Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find bloat", "what can I delete", /ponytail-audit.

Software Development10k

Ponytail Review

181k

DietrichGebert/ponytail

Quality review of a diff: bugs, security, real load, missing tests, speed, and what to delete. Each finding says what goes wrong and how to fix it.

Security10k

Springboot Verification

294k

affaan-m/ECC

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.

SecurityIn 1 list43k

Gke Basics

22k

google/skills

Manages core GKE cluster provisioning, credentials, Autopilot vs Standard selection, and workload deployment. Use when creating GKE clusters, fetching kubectl credentials, or deciding between Autopilot and Standard modes. Don't use for Workload Identity (use gke-workload-identity), GKE networking (use gke-networking), security hardening (use gke-platform-security or gke-workload-security), or cluster upgrades (use gke-upgrades).

SecurityIn 2 lists1.8k

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.