القائمة
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/diegosouzapw/awesome-omni-skill --skill audit-codeيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | audit-code |
| description | Run a single-session code review audit on the codebase |
| supports_parallel | true |
| fallback_available | true |
| estimated_time_parallel | 15 min |
| estimated_time_sequential | 50 min |
| Condition | Mode | Time |
|---|---|---|
| Task tool available + no context pressure | Parallel | ~15 min |
| Task tool unavailable | Sequential | ~50 min |
| Context running low (<20% remaining) | Sequential | ~50 min |
| User requests sequential | Sequential | ~50 min |
Task tool available, sufficient context budget
Focus Areas:
Files:
app/**/*.tsx, components/**/*.tsxlib/**/*.ts, hooks/**/*.tstypes/**/*.tsFocus Areas:
Files:
app/**/*.tsx (routing, layouts)components/**/*.tsx (component patterns)tests/**/*.test.tsFocus Areas:
Files:
lib/auth*.ts, middleware.tsfunctions/src/**/*.tsInvoke all 3 agents in a SINGLE Task message:
Task 1: hygiene-and-types agent - audit code hygiene and TypeScript patterns
Task 2: framework-and-testing agent - audit React/Next.js patterns and test
coverage Task 3: security-and-debugging agent - audit security, AI patterns,
debugging
When to use: Task tool unavailable, context limits, or user preference
Execution Order:
Total: ~50 min (vs ~15 min parallel)
{
"started_at": "ISO timestamp",
"categories_completed": ["Hygiene", "Types"],
"current_category": "Framework",
"findings_count": 18,
"last_file_written": "stage-2-findings.jsonl"
}
Step 0: Episodic Memory Search (Session #128)
Before running code audit, search for context from past code review sessions:
// Search for past code audit findings
mcp__plugin_episodic -
memory_episodic -
memory__search({
query: ["code audit", "patterns", "quality"],
limit: 5,
});
// Search for AI-generated code issues addressed before
mcp__plugin_episodic -
memory_episodic -
memory__search({
query: ["AICode", "hallucinated", "dead code"],
limit: 5,
});
Why this matters:
Step 1: Check Thresholds
Run npm run review:check and report results. If no thresholds are triggered:
Step 2: Gather Current Baselines
Collect these metrics by running commands:
# Test count
npm test 2>&1 | grep -E "Tests:|passing|failed" | head -5
# Lint status
npm run lint 2>&1 | tail -10
# Pattern compliance
npm run patterns:check 2>&1
# Stack versions
grep -E '"(next|react|typescript)"' package.json | head -5
Step 2b: Query SonarCloud (if MCP available)
If mcp__sonarcloud__get_issues is available, fetch current issue counts:
types: "CODE_SMELL,BUG" and severities: "CRITICAL,MAJOR"docs/analysis/sonarqube-manifest.md (778 issues
as of 2026-01-05)This provides real-time issue data to cross-reference with audit findings.
Step 3: Load False Positives Database
Read docs/audits/FALSE_POSITIVES.jsonl and filter findings matching:
codeexpires date passed)Note patterns to exclude from final findings.
Step 4: Check Template Currency
Read docs/templates/MULTI_AI_CODE_REVIEW_PLAN_TEMPLATE.md and verify:
If outdated, note discrepancies but proceed with current values.
Focus Areas (7 Categories):
For each category:
Category Token Requirement (MANDATORY):
category MUST be one of:
Hygiene|Types|Framework|Testing|Security|AICode|DebuggingAICode, not AICode (AI-Generated Code Failure Modes))AI-Code Specific Checks:
expect(true).toBe(true) or trivial assertionsScope:
app/, components/, lib/, hooks/, types/node_modules/, .next/, docs/tests/ excluded for code hygiene, but included when analyzing
Testing Coverage (category 4) and AI-Generated Code (category 6)All findings MUST include:
lib/utils.ts:45)Confidence Levels:
S0/S1 findings require:
Before finalizing findings, cross-reference with:
docs/audits/single-session/code/ for duplicate
findingsFindings without tool validation should note: "cross_ref": "MANUAL_ONLY"
For all S0 (Critical) and S1 (High) findings:
Document dual-pass result in finding: "verified": "DUAL_PASS_CONFIRMED" or
"verified": "DOWNGRADED_TO_S2"
1. Markdown Summary (display to user):
## Code Review Audit - [DATE]
### Baselines
- Tests: X passing, Y failing
- Lint: X errors, Y warnings
- Patterns: X violations
### Findings Summary
| Severity | Count | Top Issues | Confidence |
| -------- | ----- | ---------- | ----------- |
| S0 | X | ... | HIGH/MEDIUM |
| S1 | X | ... | HIGH/MEDIUM |
| S2 | X | ... | ... |
| S3 | X | ... | ... |
### Top 5 Issues
1. [file:line] - Description (S1/E1) - DUAL_PASS_CONFIRMED
2. ...
### False Positives Filtered
- X findings excluded (matched FALSE_POSITIVES.jsonl patterns)
### Quick Wins (E0-E1)
- ...
### Recommendations
- ...
2. JSONL Findings (save to file):
Create file: docs/audits/single-session/code/audit-[YYYY-MM-DD].jsonl
CRITICAL - Use JSONL_SCHEMA_STANDARD.md format:
{
"category": "code-quality",
"title": "Short specific title",
"fingerprint": "code-quality::path/to/file.ts::identifier",
"severity": "S0|S1|S2|S3",
"effort": "E0|E1|E2|E3",
"confidence": 90,
"files": ["path/to/file.ts:123"],
"why_it_matters": "1-3 sentences explaining impact",
"suggested_fix": "Concrete remediation direction",
"acceptance_tests": ["Array of verification steps"],
"evidence": ["code snippet", "grep output", "lint output"]
}
For S0/S1 findings, ALSO include verification_steps:
{
"verification_steps": {
"first_pass": {
"method": "grep|tool_output|file_read|code_search",
"evidence_collected": ["initial evidence"]
},
"second_pass": {
"method": "contextual_review|exploitation_test|manual_verification",
"confirmed": true,
"notes": "Confirmation notes"
},
"tool_confirmation": {
"tool": "eslint|typescript|sonarcloud|patterns_check|NONE",
"reference": "Tool output or NONE justification"
}
}
}
⚠️ REQUIRED FIELDS (per JSONL_SCHEMA_STANDARD.md):
category - MUST be code-quality (normalized from
Hygiene/Types/Framework/etc.)fingerprint - Format: <category>::<primary_file>::<identifier>files - Array with file paths (include line as file.ts:123)confidence - Number 0-100 (not string)acceptance_tests - Non-empty array of verification steps3. Markdown Report (save to file):
Create file: docs/audits/single-session/code/audit-[YYYY-MM-DD].md
Full markdown report with all findings, baselines, and recommendations.
Before finalizing the audit:
Run Validation Script:
node scripts/validate-audit.js docs/audits/single-session/code/audit-[YYYY-MM-DD].jsonl
Validation Checks:
If validation fails:
docs/audits/single-session/code/node scripts/validate-audit.js on the JSONL filenpm run validate:canon
node scripts/debt/intake-audit.js docs/audits/single-session/code/audit-[YYYY-MM-DD].jsonl --source "audit-code-[DATE]"
docs/technical-debt/MASTER_DEBT.jsonl. See
docs/technical-debt/PROCEDURE.md for the full TDMS workflow.This audit resets the code category threshold in docs/AUDIT_TRACKER.md
(single-session audits reset their own category; multi-AI audits reset all
thresholds). Reset means the commit counter for this category starts counting
from zero after this audit.
Code audit triggers (check AUDIT_TRACKER.md):
After 3 single-session code audits, a full multi-AI Code Review is recommended. Track this in AUDIT_TRACKER.md "Single audits completed" counter.
If you encounter a pattern that should be excluded from future audits:
node scripts/add-false-positive.js \
--pattern "regex-pattern" \
--category "code" \
--reason "Explanation of why this is not an issue" \
--source "AI_REVIEW_LEARNINGS_LOG.md#review-XXX"
Before running this audit, review:
node scripts/debt/intake-audit.js <output.jsonl> --source "audit-code-<date>"