| name | audit |
| description | Use when asked to audit a codebase, or when the /audit command runs — find security, correctness, and quality issues across a project and report them organized by severity. |
Code Audit
Audit the current project for security, correctness, and quality issues. Work through the codebase systematically rather than sampling files.
Procedure
- Identify the project structure, entry points, and external attack surface (network input, file input, shell commands).
- Scan for common issue classes:
- Security: injection (command/shell, path traversal), secrets in code, unsafe deserialization, missing auth/authorization, TLS misuse, dependency vulnerabilities (lockfile advisories).
- Correctness: race conditions, error paths swallowing failures, off-by-one / boundary errors, resource leaks (handles, sockets), unhandled promise rejections.
- Quality: dead code, duplicated logic, missing validation at boundaries, poor error messages, missing tests for critical paths.
- Verify suspicions against the actual code — cite file paths and line-level evidence.
- Report findings organized by severity (critical / high / medium / low), each with: location, what's wrong, why it matters, and a concrete fix suggestion.
- End with a short "healthy areas" note so the audit is balanced.
Constraints
- Do not modify code during the audit — findings only.
- If the project is small or has no security surface, say so explicitly instead of padding the report.
