audit

name	audit
description	Full codebase audit orchestrator covering security, code quality, performance, and accessibility analysis with prioritized findings.
layer	orchestrator
category	orchestration
triggers	["/audit","audit this codebase","full code audit","security audit","quality audit","review the whole project"]
inputs	["Codebase path or repository","Optional audit scope (security, quality, performance, accessibility, or all)","Optional focus areas or concerns","Optional severity threshold for reporting"]
outputs	["Categorized findings (security, quality, performance, accessibility)","Severity-ranked issue list (critical, high, medium, low, info)","Remediation recommendations per finding","Executive summary with overall health score","Actionable fix list ordered by priority"]
linksTo	["scout","code-review","test","optimize","research","debug","fix","refactor","sequential-thinking","mermaid","docs-writer","plan"]
linkedFrom	["team","ship"]
preferredNextSkills	["fix","refactor","cook","ship"]
fallbackSkills	["code-review","scout"]
riskLevel	low
memoryReadPolicy	full
memoryWritePolicy	always
sideEffects	["Reads all source files (read-only analysis phase)","May run test suite to assess coverage","May run linting tools","Produces audit report artifacts","Does NOT modify code unless explicitly asked to fix findings"]

Audit

Purpose

Audit is the comprehensive codebase analysis orchestrator. It systematically examines a codebase across four dimensions -- security, code quality, performance, and accessibility -- and produces a prioritized report of findings with remediation recommendations. Think of it as a thorough health checkup for your code.

Audit is read-only by default. It analyzes and reports but does not change code unless the user explicitly asks it to fix findings. This makes it safe to run at any time without risk of unintended changes.

Workflow

Phase 1: Scope & Inventory

1. Parse audit parameters -- Determine what to audit (full or specific dimensions) and any focus areas.
2. Invoke scout -- Build a comprehensive inventory of the codebase:
   • File count and types
   • Directory structure
   • Dependency list and versions
   • Configuration files
   • Test coverage status
   • CI/CD configuration
3. Establish baselines -- Record current metrics:
   • Test count and pass rate
   • Lint error count
   • Bundle size (if applicable)
   • Dependency count and age

Phase 2: Security Audit

4. Dependency vulnerability scan -- Check all dependencies for known vulnerabilities:
   • Outdated packages with security patches available
   • Packages with known CVEs
   • Abandoned or unmaintained dependencies
5. Secret detection -- Scan for accidentally committed secrets:
   • API keys, tokens, passwords in source code
   • Hardcoded credentials in configuration
   • Secrets in git history (if accessible)
   • Proper .gitignore coverage for sensitive files
6. Input validation analysis -- Check all user input handling:
   • SQL injection vectors (raw queries, string concatenation)
   • XSS vectors (unescaped output, unsafe innerHTML usage)
   • Command injection (exec, spawn with user input)
   • Path traversal (file operations with user input)
7. Authentication & authorization review -- Examine auth implementation:
   • Session management (secure cookies, expiration, rotation)
   • Token handling (JWT validation, refresh flow, storage)
   • Route protection (middleware coverage, missing auth checks)
   • CORS configuration
   • Rate limiting