メニュー
Comprehensive CAST codebase audit — bugs, security, performance, test coverage. Dispatches 4 parallel researchers to scan the codebase and collates findings into a dated report. Manual invocation only; monthly scheduling is a design intention (helper not yet shipped).
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | cast-audit |
| description | Comprehensive CAST codebase audit — bugs, security, performance, test coverage. Dispatches 4 parallel researchers to scan the codebase and collates findings into a dated report. Manual invocation only; monthly scheduling is a design intention (helper not yet shipped). |
| user-invocable | true |
| allowed-tools | ["Agent","Read","Glob","Grep"] |
The /cast-audit skill automates the 4-way codebase audit that was run manually on 2026-04-16, surfacing accumulating drift and regressions before they compound. It dispatches 4 parallel researchers (bugs/dead code, security, performance, test coverage), collates findings, and writes a report to ~/.claude/reports/cast-audit-YYYY-MM-DD.md.
Does NOT auto-fix. This skill surfaces findings only. Remediation happens via follow-up agent dispatch (debugger, security, test-writer).
/cast-audit
Runs full audit and writes report to ~/.claude/reports/cast-audit-YYYY-MM-DD.md.
/cast-audit --since 2026-03-01 — Only flag regressions (increases, new findings) since the date. Compares against the most recent prior audit before that date./cast-audit --section security — Run one section only (security, bugs, performance, or coverage). Output still goes to the full report./cast-audit --no-collate — Run 4 parallel researchers but do NOT collate into a single report. Useful for debugging individual sections.Design intention: first Monday of each month, 08:00 local time. Scheduling via RemoteTrigger or cron requires a helper script that is not yet shipped (see "Scheduling" below). Manual invocation only until then.
The scheduled run:
~/.claude/reports/cast-audit-YYYY-MM-DD-<section>.md~/.claude/reports/cast-audit-YYYY-MM-DD.mdEach audit produces a collated report with this structure:
# CAST Audit — YYYY-MM-DD
## Executive Summary
- 🔴 HIGH: [top 1-2 findings by severity]
- 🟡 MED: [secondary findings]
- 🟢 LOW: [informational findings]
Comparison to prior audit (YYYY-MM-DD):
- +3 HIGH / -1 MED / +2 LOW severity
## Findings by Category
### Bugs & Dead Code
[Bulleted findings with severity tags, file paths, line numbers]
### Security
[Bulleted findings]
### Performance
[Bulleted findings]
### Test Coverage
[Bulleted findings]
## Recommended Actions
| Finding | Severity | Recommended Agent | Effort |
|---|---|---|---|
| ... | HIGH | debugger | ~30 min |
Example finding:
- 🔴 HIGH (SECURITY): `scripts/cast-session-end.sh:42` — SQL injection via unquoted SESSION_ID in sqlite3 insert. Use parameterization or add validation guard.
Each section report (written to ~/.claude/reports/cast-audit-YYYY-MM-DD-<section>.md) contains raw findings for that category.
Scan for:
settings.json but missing from scripts/)~/.claude/agents/ but not referenced anywhere)~/.claude/skills/ but not wired)Scan for:
owns_files spec)Scan for:
python3 -c > 2 per script)~/.claude/logs/ if available)Scan for:
scripts/ without corresponding tests/<name>.batssrc/components/ without .test.tsxWhen invoked, the main session:
Dispatches 4 researchers in parallel, each with a targeted scope:
Researcher 1 (bugs): Scan scripts/, agents/, skills/ for orphan, unreachable, and cold-start patterns
Researcher 2 (security): Scan all code for SQL injection, shell injection, secrets, file perms
Researcher 3 (performance): Scan for cold-starts, slow queries, unbounded work
Researcher 4 (coverage): Compare test files against source files in scripts/, src/
Each researcher writes findings to:
~/.claude/reports/cast-audit-YYYY-MM-DD-bugs.md
~/.claude/reports/cast-audit-YYYY-MM-DD-security.md
~/.claude/reports/cast-audit-YYYY-MM-DD-performance.md
~/.claude/reports/cast-audit-YYYY-MM-DD-coverage.md
Main session collates the 4 reports into:
~/.claude/reports/cast-audit-YYYY-MM-DD.md
With executive summary, side-by-side comparison to prior audit (if available), action items, and recommended agents.
Idempotency: Running /cast-audit twice on 2026-04-16 overwrites cast-audit-2026-04-16.md and the section files.
Create a scheduled task that invokes Claude Code with:
claude-code \
--message "Dispatch /cast-audit skill to run monthly audit." \
--cwd ${HOME}/Projects/personal/claude-agent-team
Schedule: First Monday of each month at 08:00 local time
Example crontab entry (not yet functional — requires scripts/cast-audit-cron.sh which has not been shipped):
# First Monday of month at 08:00 local — CAST audit (illustrative only)
# 0 8 * * 1 [ $(date +\%d) -le 7 ] && cd ${HOME}/Projects/personal/claude-agent-team && bash scripts/cast-audit-cron.sh
Create scripts/cast-audit-cron.sh first if cron scheduling is actually adopted.
~/.claude/reports/cast-audit-YYYY-MM-DD.md. Updated README documents this path.~/.claude/reports/cast-audit-YYYY-MM-*.md, collation step compares finding counts by severity and flags regressions (e.g., "+3 HIGH since last month")./cast-audit skill exists with clear invocation instructions~/.claude/reports/cast-audit-YYYY-MM-DD-<section>.md~/.claude/reports/cast-audit-YYYY-MM-DD.md with executive summaryShared CAST conventions for all agents. Loaded automatically via agent frontmatter.
Execute a CAST plan by reading the Agent Dispatch Manifest and dispatching agents in dependency order — parallel batches simultaneously, sequential batches one at a time. Pass a plan file path, 'next' for the most recent plan, or 'resume' to continue from a checkpoint.
Full CAST agent registry with model assignments. Load when building an Agent Dispatch Manifest, orchestrating multi-agent workflows, or when you need to verify which model a specific agent runs on.
Assemble morning briefing sections into a structured markdown file. Use when writing the final briefing output after all data sources have been gathered.
Activate careful mode — require explicit confirmation before any Write, Edit, or Bash operations. Use when working on production code or sensitive systems.
Deep research harness — fan-out web searches, fetch sources, adversarially verify claims, synthesize a cited report. When the user wants a deep, multi-source, fact-checked research report on any topic. BEFORE invoking, check if the question is specific enough to research directly — if underspecified (e.g., "what car to buy" without budget/use-case/region), ask 2-3 clarifying questions to narrow scope. Then pass the refined question as args, weaving the answers in.