Atlas / Skills / revfactory / Sustainability Audit

Sustainability AuditSAFE

skills/revfactory/sustainability-audit
Verdict
SAFE
Grade
B
Trust score
89 /100
Version
—
Hosts
—
License
Apache-2.0
Stars
1,297
01

Overview

An agent skill published by revfactory.

Read from source at commit 459e1bb8f76eOBSERVED · 2026-10-12
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: sustainability-audit
description: "Full audit pipeline for ESG/sustainability where an agent team collaborates to generate environmental, social, and governance assessments along with an integrated report and improvement plan. Use this skill for requests such as 'run an ESG audit', 'write a sustainability report', 'ESG assessment', 'carbon emissions calculation', 'ESG rating diagnosis', 'governance review', 'social responsibility assessment', 'GRI report', 'TCFD disclosure', 'ESG improvement plan', and other ESG/sustainability tasks. Also supports assessment of specific pillars (E/S/G) only or improving existing reports. However, actual on-site audit execution, third-party verification certificate issuance, ESG rating agency score changes, and carbon credit trading are outside the scope of this skill."
---

# Sustainability Audit — ESG/Sustainability Audit Full Pipeline

An agent team collaborates to generate environmental, social, and governance assessments along with an integrated report and improvement plan.

## Execution Mode

**Agent Team** — 5 members communicate directly via SendMessage and cross-validate each other's work.

## Agent Roster

| Agent | File | Role | Type |
|-------|------|------|------|
| environmental-analyst | `.claude/agents/environmental-analyst.md` | Carbon emissions, energy, waste, water resources | general-purpose |
| social-assessor | `.claude/agents/social-assessor.md` | Labor, human rights, DEI, supply chain | general-purpose |
| governance-reviewer | `.claude/agents/governance-reviewer.md` | Board, ethics, compliance | general-purpose |
| esg-reporter | `.claude/agents/esg-reporter.md` | GRI/SASB/TCFD report writing | general-purpose |
| improvement-planner | `.claude/agents/improvement-planner.md` | Improvement roadmap, KPIs, investment plan | general-purpose |

## Workflow

### Phase 1: Preparation (Performed Directly by Orchestrator)

1. Extract from user input:
    - **Company Information**: Company name, industry, size (revenue/headcount), listing status
    - **Audit Scope** (optional): Full E/S/G or specific pillars
    - **Existing Materials** (optional): Annual reports, existing ESG reports, emissions data
    - **Objectives** (optional): ESG rating target, regulatory compliance, investor requirements
    - **Constraints** (optional): Timeline, budget, specified reporting framework
2. Create the `_workspace/` directory at the project root
3. Organize the input and save it as `_workspace/00_input.md`
4. If existing files are provided, copy them to `_workspace/` and use as reference materials
5. **Determine the execution mode** based on the scope of the request

### Phase 2: Team Assembly and Execution

| Order | Task | Owner | Dependencies | Deliverable |
|-------|------|-------|-------------|-------------|
| 1a | Environmental Assessment | environmental | None | `_workspace/01_environmental_assessment.md` |
| 1b | Social Assessment | social | None | `_workspace/02_social_assessment.md` |
| 1c | Governance Assessment | governance | None | `_workspace/03_governance_assessment.md` |
| 2 | Integrated Report | reporter | Tasks 1a, 1b, 1c | `_workspace/04_esg_report.md` |
| 3 | Improvement Plan | planner | Tasks 1a, 1b, 1c, 2 | `_workspace/05_improvement_plan.md` |
| 4 | Cross-Validation | orchestrator | All | `_workspace/06_review_report.md` |

Tasks 1a, 1b, and 1c (E/S/G assessments) run **in parallel**. The three pillars can be assessed independently.

**Inter-Agent Communication Flow:**
- E/S/G analysts mutually: Cross-share inter-pillar issues (environmental -> social impact, governance -> environmental policies)
- E/S/G complete -> deliver pillar data and ratings to reporter
- E/S/G complete -> deliver weaknesses, risks, and improvement opportunities to planner
- reporter completes -> deliver report targets/commitments to planner
- orchestrator cross-validates overall consistency

### Phase 3: Integration and Final Deliverables

1. Verify consistency across all files in `_workspace/`
2. Detect discrepancies across E/S/G assessments, report, and improvement plan
3. Generate the cross-validation report
4. Report the final summary to the user

## Execution Modes by Scope

| User Request Pattern | Execution Mode | Agents Deployed |
|---------------------|---------------|-----------------|
| "Run an ESG audit", "Sustainability report" | **Full Audit** | All 5 agents |
| "Just calculate carbon emissions" | **Environmental Only** | environmental only |
| "Just review governance" | **Governance Only** | governance only |
| "Create an ESG improvement plan" + existing report | **Improvement Mode** | planner only |
| "Convert this report to GRI format" | **Report Mode** | reporter only |
| "Just review environmental and social" | **Partial Audit** | relevant pillars + reporter |

**Using Existing Files**: When the user provides existing ESG reports, annual reports, etc., use them as reference materials to improve accuracy.

## Data Transfer Protocol

| Strategy | Method | Purpose |
|----------|--------|---------|
| File-Based | `_workspace/` directory | Store and share main deliverables |
| Message-Based | SendMessage | Cross-pillar issue sharing, correction requests |
| Task-Based | TaskCreate/TaskUpdate | Progress tracking, dependency management |

File naming convention: `{order}_{deliverable}.{extension}`

## Error Handling

| Error Type | Strategy |
|-----------|----------|
| Company data unavailable | Estimate using industry averages, attach "Estimate" label |
| Web search failure | Work with general ESG standards, note "Data limitations" |
| Industry-specific standards unknown | Search based on SASB industry classification, apply general standards if unavailable |
| Agent failure | Retry once -> if still fails, proceed with that pillar omitted |
| E/S/G inconsistency | Detected in cross-validation -> request corrections from relevant agent (up to 2 rounds) |

## Test Scenarios

### Normal Flow
**Prompt**: "Run an ESG audit for our company 
03

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (1)

LOWPrompt injection · review.misleading_scope · CWE-94, CWE-1427
en/100-ip-portfolio/.claude/agents/license-strategist.md
IP license strategist. Develops IP asset monetization strategies, cross-licensing, technology transfer, and open source strategies
Why it matters. The package description claims to provide ESG/sustainability audit capabilities but includes unrelated agent definitions for IP licensing and open source compliance, misleading users about the package's actual scope.
Fix. rewrite it so the instruction says plainly what it does, and asks the user before it acts

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 459e1bb8f76efull audit observations/trust-audit/skill/revfactory__sustainability-audit.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-12459e1bb8f76eSAFEB89first audit
05

Questions

Is Sustainability Audit safe to install?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.

What can Sustainability Audit access on my machine?

The audit observed no filesystem, network or shell use at all in its source.

How current is this page?

The grade is for one exact copy of the source (459e1bb8f76e), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement