ponytail-audit Skill for Claude: Audit Your Whole Repo
Makes Claude audit your whole repo like a senior developer, and hand back a ranked report of bugs, risks and bloat.
- Installs
- 50.5K
- on skills.sh
- Stars
- 182K
- on GitHub
- Updated
- Oct 2026
- last repo commit
You type /ponytail-audit, and the agent maps the repo, reads the main flows, and writes one report. Findings are grouped as Must fix, Should fix and Nice to have, numbered so you can say "fix 2 and 5". Each has four parts: what the code is, the problem, the fix, and what happens if you skip it.
SKILL.md says it is a one-shot report that changes no code, and it caps the report at 20 findings. You can name a folder or package to audit instead of the whole repo. It bundles no scripts and names no API key.
Good for
- Developers who inherited a codebase and need to know what to fix first
- Tech leads who want a plain-English risk list before a release
- Anyone who wants to find dead code and unneeded dependencies
Install ponytail-audit
Claude Code
- 1
Copy this prompt.
Install the ponytail-audit skill in Claude Code. Run this command: npx skills add https://github.com/dietrichgebert/ponytail --skill ponytail-audit Then check that it loaded and tell me how to use it.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Node.js.
Pick one route, not both. The skills CLI and folder routes install only ponytail-audit, a folder holding SKILL.md. The plugin route is the README install: it adds ponytail itself and all six skills, and also registers hooks and a task board (see Permissions and safety). Run the two plugin commands as separate prompts. Claude Code names plugin skills plugin-name:skill-name, so after the plugin install the full name may be /ponytail:ponytail-audit; the README lists /ponytail-audit.
From its listing on skills.sh. Source.
What's in the skill
When it loads
Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find bloat", "what can I delete", /ponytail-audit.
Sections in SKILL.md
- 1. Map first
- 2. Look for
- 3. Check before you report
- 4. Output
Key facts
- Author
- dietrichgebert
- Repository
- dietrichgebert/ponytail
- License
- MIT
- Installs on skills.sh
- 50,468 (Nov 2, 2026)
- GitHub stars
- 182,027 (Nov 2, 2026)
- Last repo commit
- Oct 29, 2026
What it includes
Runs a quality audit of the repo and returns one ranked report
Triggers on /ponytail-audit or phrases like "audit this codebase", "review the whole repo", "find bloat".
Try: “/ponytail-audit”
Files ·
/ponytail-auditReads README, config, dependencies, entry points and tests; states the load it assumed
You can name a folder or package. On a big repo it goes deep where a mistake costs most and says which parts it did not read.
Files ·
1. Map firstBug, Risk, Scale, Missing test, Speed, Lean
Lean covers delete, reuse, stdlib or native, yagni, merge and split.
Read ·
2. Look for six kinds of problemEvery finding needs a concrete case; it searches the tree before calling code unused
A `shortcut:` comment that names its limit counts as a decision, not a finding, unless the load already crosses it.
Files ·
3. Check before reportingStarts with what the repo does, ends with a verdict and what was not checked
Groups: Must fix, Should fix, Nice to have. Ends with Verdict, Lean totals when relevant, and Not checked.
4. Write the report
From the official docs
Permissions
Low risk
It reads your code to write the report, so everything it opens goes to the model. SKILL.md says it is a one-shot report that changes no code.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only modeHow to turn it on
Watch out for
Plugin route registers hooks that run Node scripts
The plugin manifest points to hooks that run Node scripts at session start, when a subagent starts and on every prompt. The session-start script writes a flag file under your Claude config folder (default ~/.claude), runs a codebase-map script, and can copy a statusline script into that folder. Installing only this skill adds none of these.
It reads your whole repo into the model
The audit opens README, config, dependencies, entry points and the main code paths. Skip it on repos you cannot share with your AI provider, or name one folder.
Plugin route writes a task board to disk every turn
By default the band records one row per turn (cost, turns, agent time, tokens, reuse, tests) to ~/.config/ponytail/band/<project>.csv and rebuilds a board.html there. It runs git grep and grep over your repo and session transcript to compute them. /ponytail band import reads your past Claude Code sessions into the board.
Plugin route has an optional webhook
If you set a webhook URL in the plugin options, each task row is posted to it as JSON after every turn, with the task name unless you turn that off. The URL is empty by default and the token is stored in the system keychain, per the manifest.
The report can miss parts of a big repo
On large repos it says which parts it did not read in a Not checked line. Read that line before trusting a Healthy verdict.
Technical details
| Turning on read-only | SKILL.md says it is a one-shot report that changes no code. |
|---|---|
| Talks to | Only if you set the plugin webhook URL: your own endpoint |
Questions
What does ponytail-audit do?
It audits a whole repo, or a folder you name, and returns a ranked report. It looks for bugs, security holes, code that breaks under load, risky code without tests, slow paths, and code to delete, merge or split.
How do I run ponytail-audit?
Type /ponytail-audit in an agent that has the skill, or ask to "audit this codebase". Name a folder or package if you do not want the whole repo audited.
How do I install ponytail-audit?
Use the install box above. Its Claude Code tab has two routes: the skills CLI, which installs only ponytail-audit (a folder holding SKILL.md), and the full ponytail plugin from the README (two /plugin commands). Pick one, not both. There are also Claude app, Codex and skills CLI tabs.
Should I install the whole ponytail plugin instead?
The README's Claude Code route is the full plugin: two /plugin commands that add ponytail itself and its six skills. Beyond the skills, the plugin manifest registers hooks that run Node scripts at session start, when a subagent starts and on every prompt, plus a band above the prompt. By default its task board writes one row per turn to ~/.config/ponytail/band/<project>.csv, and an optional webhook URL is empty by default. Install the plugin if you want ponytail itself; install only this skill if you want just this command.
Will ponytail-audit change my code?
No. SKILL.md ends with "One-shot report, changes no code." It proposes fixes in the report and leaves applying them to you.
Is ponytail-audit safe to run?
It reads your repo and writes a report, and SKILL.md says it changes no code. The cost is privacy: the files it reads go to your AI model, so avoid it on code you cannot share. The skill bundles no scripts and names no API key.
ponytail-audit vs ponytail-review?
Per the ponytail-help card, ponytail-review checks a diff and ponytail-audit runs the same quality review on the whole repo, ranked. Use review before you merge a change and audit when you inherit or revisit a codebase.
Information
updated Nov 2, 2026
- Repository
- dietrichgebert/ponytail
- Folder
skills/ponytail-audit
Sources
Docs, issue trackers and discussions this page is built from.
Show all 10Hide
- ponytail README · github.com
- ponytail Claude plugin manifest · github.com
- ponytail-audit SKILL.md · github.com
- skills CLI commands · github.com
- ponytail Codex plugin manifest · github.com
- ponytail-help SKILL.md · github.com
- ponytail-audit on skills.sh · skills.sh
- ponytail hooks config · github.com
- ponytail band module · github.com
- ponytail session-start hook · github.com