docs(cli): add orbit-station-audit Claude Code skill

[aterga]

What

Adds a project skill at .claude/skills/orbit-station-audit/ that takes an agent from a fresh checkout to a successful orbit-cli audit run against a live station.

.claude/skills/orbit-station-audit/
├── SKILL.md              # operational guide
└── scripts/run-audit.sh  # build-from-source → repair generated IDL → run audit

Why

The existing cli/src/audit/README.md documents flags, exit codes, and report format well — but a first run still trips on operational details that aren't in the README. This skill front-loads exactly those, and points to the README for reference rather than duplicating it.

The four gotchas it captures (all hit live while writing it):

1. The global orbit-cli is unreliable — it either predates the audit subcommand, or (after a pnpm install, which rebuilds + pnpm link --global re-exposes via the prepare-cli postinstall) carries the build bug below and crashes. Build and run the repo's cli/dist/cli.js directly.
2. The built CLI crashes with SyntaxError: Unexpected token 'export' — the build script copies the generated station.did.js (an ES module) into the CommonJS bundle, so require() can't parse it. The helper script repairs the dist copy after each build. The real fix belongs in the CLI build itself — happy to follow up with that separately.
3. Internet Identity principals are per-origin — the audit must be called by a principal the station knows as a member, so the icp-cli identity must be derived from orbitwallet.io (the derivationOrigin pinned in apps/wallet/src/configs/init.config.ts), passed as a bare host to --app.
4. icp identity link web waits for an Enter keypress before opening the browser — pipe printf '\n' when running it non-interactively.

Verification

Built from a deliberately re-broken (clean) state, the helper script repaired the IDL and ran the audit end-to-end against a mainnet station, producing a severity-sorted report (exit code 2). The content was checked by a three-lens review (cold-execution, conciseness, factual-accuracy) against the codebase; all load-bearing claims verified.

🤖 Generated with Claude Code

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 2c8d2b5.

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=d10d9c25-e826-4649-afa4-25f11b806403&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► .claude/skills/orbit-station-audit/SKILL.md     Add SKILL.md for orbit-station-audit ► .claude/skills/orbit-station-audit/scripts/run-audit.sh     Add run-audit.sh script to build and run orbit-cli audit

[Copilot]

Pull request overview

Adds a Claude project skill that guides users from a fresh Orbit checkout to a successful orbit-cli audit run against a live station, including the common identity-derivation pitfalls and a helper script to build + run the audit reliably.

Changes:

• Added a new skill guide describing the end-to-end operational steps and common “first run” gotchas for orbit-cli audit.
• Added a helper script that installs deps (if needed), builds orbit-cli, repairs the generated IDL ESM/CJS mismatch in dist, and executes the audit.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.claude/skills/orbit-station-audit/SKILL.md	Operational documentation for running orbit-cli audit reliably (identity setup + troubleshooting).
.claude/skills/orbit-station-audit/scripts/run-audit.sh	Automates build + IDL repair + forwarding args to orbit-cli audit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.