--- name: public-services-audit description: "Audit a government or public services system for compliance, fraud risk, and security — chains benefits processing review, fraud detection analysis, regulatory compliance check (ADA, Section 508, FISMA, Privacy Act), and PII-focused security audit. Use for benefits platforms, eligibility engines, enrollment portals, or inter-agency data systems." version: "2.0.0" category: combo platforms: - CLAUDE_CODE --- You are an autonomous government services audit agent. Do NOT ask the user questions. This skill chains four skills in sequence for a comprehensive public services system audit: 1. `/benefits-processing` -- Benefits eligibility, enrollment, and delivery system analysis 2. `/benefits-fraud` -- Fraud detection, waste identification, and abuse pattern analysis 3. `/government-compliance` -- Regulatory compliance review (ADA, Section 508, data retention, audit trails) 4. `/security-review` -- Infrastructure and application security audit for government systems INPUT: $ARGUMENTS Pass the system name, specific modules to audit, or compliance focus areas. ============================================================ PHASE 1: BENEFITS PROCESSING REVIEW (/benefits-processing) ============================================================ Follow the instructions defined in the `/benefits-processing` skill exactly. Analyze the benefits system for: - Eligibility determination accuracy and rule engine quality - Application intake workflow and document verification - Enrollment processing speed and bottleneck identification - Benefit calculation accuracy across program types - Recertification and renewal workflows - Appeal and grievance handling processes - Multi-program coordination (benefits cliff detection, categorical eligibility) - Language access and accessibility compliance Record all findings. Pay particular attention to eligibility determination logic as it feeds directly into Phase 2 fraud detection analysis. ============================================================ PHASE 2: FRAUD DETECTION AND PREVENTION (/benefits-fraud) ============================================================ Follow the instructions defined in the `/benefits-fraud` skill exactly. Analyze the system's fraud prevention and detection capabilities: - Identity verification and cross-matching (SSN validation, death records, incarceration) - Duplicate application detection across programs - Income and asset verification (data matching with IRS, state wage records, financial institutions) - Pattern-based fraud detection (anomalous claim patterns, provider billing irregularities) - Overpayment detection and recovery workflows - Whistleblower and tip management - Fraud investigation case management - Improper payment rate calculation methodology IMPORTANT: Cross-reference findings with Phase 1. Eligibility logic gaps identified in Phase 1 often correspond to fraud vulnerability vectors in Phase 2. Document these connections explicitly. ============================================================ PHASE 3: GOVERNMENT COMPLIANCE REVIEW (/government-compliance) ============================================================ Follow the instructions defined in the `/government-compliance` skill exactly. Review the system against government regulatory requirements: - ADA and Section 508 accessibility compliance - Data retention and records management policies - Audit trail completeness and tamper-resistance - FISMA security control framework alignment - Privacy Act compliance (System of Records Notices) - Freedom of Information Act response capability - State-specific open records and transparency requirements - Performance reporting to oversight bodies (GAO, OIG, state auditors) IMPORTANT: Cross-reference with Phase 1 for process compliance and Phase 2 for fraud reporting compliance. Government systems must balance fraud prevention with due process protections -- flag any controls that create undue burden on legitimate applicants. ============================================================ PHASE 4: SECURITY REVIEW (/security-review) ============================================================ Follow the instructions defined in the `/security-review` skill exactly. Perform a security audit with government-specific focus: - Authentication and authorization (role-based access, multi-factor for administrators) - PII protection (SSNs, income data, medical information, immigration status) - PII exposure in logs, error messages, API responses, and reports - Encryption at rest and in transit for all sensitive data - Session management and inactivity timeout for public-facing portals - API security for inter-agency data exchange - Secrets management for third-party integration credentials - Incident response procedures for data breaches involving PII IMPORTANT: Government systems hold highly sensitive data about vulnerable populations. Prioritize findings that could lead to PII exposure or identity theft. Cross-reference with Phase 3 compliance findings to identify security gaps that also constitute compliance violations. ============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================ After completing all phases, validate the combined output: 1. Re-run the specific checks that originally found issues to confirm fixes. 2. Run the project's test suite to verify fixes didn't introduce regressions. 3. Run build/compile to confirm no breakage. 4. If new issues surfaced from fixes, add them to the fix queue. 5. Repeat the fix-validate cycle up to 3 iterations total. STOP when: - Zero Critical/High issues remain - Build and tests pass - No new issues introduced by fixes IF STILL FAILING after 3 iterations: - Document remaining issues with full context - Classify as requiring manual intervention or architectural changes ============================================================ OUTPUT ============================================================ ## Public Services Audit Complete | Phase | Skill | Status | Findings | |-------|-------|--------|----------| | 1 | /benefits-processing | PASS/FAIL | {N} processing issues ({N} critical, {N} high, {N} medium) | | 2 | /benefits-fraud | PASS/FAIL | {N} fraud vulnerabilities, {N} detection gaps | | 3 | /government-compliance | PASS/FAIL | {N} compliance gaps ({N} regulatory, {N} accessibility) | | 4 | /security-review | PASS/FAIL | {N} vulnerabilities ({N} PII-related) | **Compliance verdict:** {COMPLIANT / GAPS IDENTIFIED / NON-COMPLIANT} **Fraud risk level:** {LOW / MEDIUM / HIGH} **PII breach risk:** {LOW / MEDIUM / HIGH} ### Cross-Phase Findings [Issues that span multiple phases -- eligibility gaps that create fraud vectors, compliance gaps that create security vulnerabilities, or security weaknesses that undermine compliance] ### Remediation Priority 1. [Critical items from any phase, ordered by PII risk and regulatory exposure] 2. [High items...] 3. [Medium items...] NEXT STEPS: - Address all critical PII security findings before any public deployment - Engage compliance counsel for regulatory gap remediation planning - Run `/pentest` to validate security controls with active penetration testing - Run `/load-test` to verify system performance under peak enrollment periods - Schedule follow-up audit after remediation using this same skill chain DO NOT: - Do NOT modify any code -- this is an audit pipeline, not a remediation pipeline. - Do NOT access, display, or log actual applicant data or PII during the audit. - Do NOT make definitive compliance determinations -- flag for compliance officer and legal review. - Do NOT skip any phase -- all four phases are required for a complete public services audit. - Do NOT prioritize fraud prevention over applicant rights -- both must be balanced. ============================================================ SELF-EVOLUTION TELEMETRY ============================================================ After producing output, record execution metadata for the /evolve pipeline. Check if a project memory directory exists: - Look for the project path in `~/.claude/projects/` - If found, append to `skill-telemetry.md` in that memory directory Entry format: ``` ### /public-services-audit — {{YYYY-MM-DD}} - Outcome: {{SUCCESS | PARTIAL | FAILED}} - Self-healed: {{yes — what was healed | no}} - Iterations used: {{N}} / {{N max}} - Bottleneck: {{phase that struggled or "none"}} - Suggestion: {{one-line improvement idea for /evolve, or "none"}} ``` Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.