tomtom-audit-report

name	tomtom-audit-report
description	Run a TomTom implementation audit on the current project, write AUDIT_TODO.md with actionable TODO items, and open/update a GitHub issue. Invoke via /tomtom-audit-report from within the project. Requires the tomtom-implementation-best-practices skill to be installed.

TomTom Audit Report Generator

You generate a structured, agent-consumable TODO report from a TomTom implementation audit.

Dependency check

Before running, confirm the tomtom-implementation-best-practices skill is available (it should appear in your skill list). If it is not, stop and tell the user to install it first.

Execution steps

Step 1 — Run the full audit

Use the Skill tool to invoke tomtom-implementation-best-practices with the instruction:

"please audit this repository"

Let it run to completion. Collect all findings across all six lenses (SDK currency, API key hygiene, cost surface, stability, correctness, MCP integration).

Step 2 — Format findings as a TODO checklist

Convert every actionable finding into the format below. Each item must be completable by a coding agent that reads only this file — include the exact file path, line number, and the specific change to make.

# TomTom Audit TODO

> Generated by `/tomtom-audit-report` on YYYY-MM-DD.
> Re-run this command to refresh findings. Check off items as they are fixed.

## 🔴 Critical
- [ ] **`path/to/file.ts:line`** Short imperative title — one sentence explaining the exact change needed.

## 🟠 High
- [ ] ...

## 🟡 Medium
- [ ] ...

## 🟢 Low / Nits
- [ ] ...

## References
- [TomTom docs link](url)

Rules:

• Every item must name a file and line (or the file if the fix spans multiple lines).
• Pure informational findings with no code change (e.g., "verify your contract pricing") belong under a ## Notes section at the bottom, not as checkboxes.
• Do not invent items not present in the audit output.
• Do not include findings that are already fixed (check git status / recent commits before writing).
• Omit severity sections that have zero items.
• TomTom scope only. Only include findings from the six TomTom-specific lenses (SDK currency, API key hygiene, cost surface, stability, correctness, MCP integration). Discard any finding that is purely about general code quality — e.g. removing comments, deleting unused files or variables, formatting, naming conventions, or structural refactors unrelated to TomTom API/SDK usage. Those belong in a separate code-quality pass, not here.

Step 3 — Write AUDIT_TODO.md

Write the formatted content to AUDIT_TODO.md in the current working directory, overwriting any existing file.

Step 4 — Commit AUDIT_TODO.md

Commit AUDIT_TODO.md to the current branch so it is persisted for downstream workflows:

git add AUDIT_TODO.md
git diff --cached --quiet || git commit -m "chore: update AUDIT_TODO.md from audit run"
git push origin HEAD

If git push fails (e.g. no remote, not authenticated), skip silently and note it in the final report.

Step 5 — Create or update the GitHub issue

Run the following to find an existing open audit issue:

gh issue list --search "title:\"TomTom Audit Findings\"" --state open --json number,title --limit 1

• If an issue is returned: update its body with gh issue edit <number> --body "<content>"
• If no issue exists: create one with:

  gh issue create --title "TomTom Audit Findings" --body "<content>"
  

Use the identical markdown content as AUDIT_TODO.md for the issue body.

If gh is not authenticated, there is no GitHub remote, or the command fails for any reason: skip this step silently and note it in the final report to the user.

Step 6 — Report back

Tell the user:

• Path to AUDIT_TODO.md (confirm it was written and committed)
• GitHub issue URL
• Item count by severity (e.g., "1 Critical, 1 High, 3 Medium, 3 Low")