audit-skill-kit

Review the JS/Node package & build layer in ANY repo — lockfile integrity (drift that installs but fails `npm ci`), package-manager hygiene (single lockfile + packageManager pin), dependency-bump safety (minimal-compatible, clean regen), and test-runner↔runtime compatibility (e.g. vitest 4 vs Node 18). Reports ✅/⚠️/❌; optional --gold emits verified findings as portable training pairs. Use after a dependency bump, before merging a lockfile change, or to audit a repo's supply-chain hygiene.

Security-scoped TypeScript/JavaScript review for ANY repo — input validation, subprocess spawning, env/secret leakage, path traversal, file permissions, and error discipline. NOT a style linter (tsc + ESLint cover that); fires only on code crossing a trust boundary. Reports ✅/⚠️/❌ per check; optional --gold emits verified findings as portable training pairs. Use after writing or when handed TS/JS that accepts user input, spawns processes, writes files, or touches process.env.

A fearless privacy & security inventory of ANY app that holds sensitive user data — hunts the gap between what privacy/security the code CLAIMS and what it actually ENFORCES. DB/ecosystem-agnostic. Reports 🔴/🟠/🟡/🟢 per check; optional --gold emits verified findings as portable training pairs. Use before a public release, before shipping a sensitive feature (matching/sharing/DMs/AI-over-user-data), or after adding auth/payments/PII/AI.

Review SQL migrations and queries in ANY repo for safety, RLS correctness, function security, concurrency, blanket grants, and query quality. DB/ORM-agnostic. Reports ✅/⚠️/❌ per check; optional --gold emits verified findings as portable training pairs. Use when reviewing a .sql migration, an ORM schema (Prisma/Drizzle/Kysely), or a raw query — especially before deploying schema changes to a multi-tenant or user-data app.