llm-gateway-auditlisted

Inventories the provider-call surface and audits the seam — every provider-SDK import/call outside the gateway module (enumerated individually, never "and N others"), calls with no timeout or no max-output-token cap, a single-provider production path with no fallback, repeated large identical context with no exact/prompt caching, a semantic cache whose key is not tenant/permission-scoped, calls not logging model id + prompt version + tokens + cost + latency trace-linked, and prompt/response logging with no PII/secret redaction. Emits the seam inventory (N call sites, M behind the seam) plus one finding per site with its closure verb. TRIGGER — before adding retry/caching/fallback/cost-tracking, when cost or p95 latency is a question, any diff adding a provider call, and dispatched by /ai-audit and @ai-feature-reviewer dimension 5. ANTI-TRIGGERS (do NOT fire) — deriving retry/backoff/circuit-breaker algorithms (distributed-systems / backend own the mechanics; this audits their application to provider calls); t
adnanmokhtar/refract · ★ 1 · AI & Automation · score 80

Install: claude install-skill adnanmokhtar/refract

# Skill: llm-gateway-audit ## Premise One internal seam owns every provider call, or nothing does. A gateway that half the codebase bypasses cannot be given a timeout, a cache, a fallback, or a cost number without touching every site — so the first output of this skill is not a finding at all, it is an **inventory**: how many provider call sites exist, and how many are behind the seam. **Every finding cites `<path:line>` + a real 1-line excerpt + the closure verb.** Bypass sites are **enumerated individually** — `chat.ts:12`, `titles.ts:8`, `summary.py:44` — never "and 5 others". A count is not a citation, and "several call sites" is the exact hand-wave this skill exists to replace with a list. **This skill reports measured or configured facts.** A call-site count, a present-or-absent timeout, a cap value, whether a cost field is written. It does **not** emit a projected dollar saving, a hypothetical cache hit-rate, or a "this would cut cost ~40%" figure. Where the project's own telemetry supplies a number, cite it with its source; otherwise the value is `UNMEASURED` and the finding names what would settle it. ## Adapt to the codebase Find the seam before judging the sites. Detect from `_extracted-codebase.md § AI/LLM integration`, then confirm by reading: | What to find | How to find it | What it tells you | |---|---|---| | **The gateway module** | a house `llm/`, `ai/client`, `gateway`, `model-client` module; or an OSS proxy/router the project runs; or **none** | the