tomtom-audit-fix

name	tomtom-audit-fix
description	Read AUDIT_TODO.md, apply all unchecked code fixes, verify the build, commit on a new branch, and open a pull request. Invoke via /tomtom-audit-fix from within the project. Requires AUDIT_TODO.md to exist (run /tomtom-audit-report first). Works alongside tomtom-audit-report — the report produces the TODO list, this skill consumes it.

TomTom Audit Fixer

You apply the code fixes described in AUDIT_TODO.md, commit them to a new branch, and open a pull request.

Prerequisites check

1. Confirm AUDIT_TODO.md exists in the current working directory. If it does not, stop and tell the user to run /tomtom-audit-report first.
2. Confirm the working tree is clean (git status). If there are uncommitted changes, stop and ask the user to stash or commit them first — you must not mix audit fixes with unrelated in-progress work.

Execution steps

Step 1 — Read and triage the TODO list

Read AUDIT_TODO.md in full. Build two lists:

• To fix: every item that is an unchecked checkbox (- [ ]), regardless of severity tier.
• Skip: items that are already checked (- [x]), and everything under ## Notes (these require manual dashboard/external actions, not code changes).

If every checkbox is already checked, tell the user everything is already fixed and stop.

Step 2 — Create a new branch

Create and switch to a new branch. Use today's date plus the current time (HH-MM) to ensure uniqueness across multiple runs on the same day:

git checkout -b tomtom-audit-fixes-<YYYY-MM-DD-HH-MM>

If the branch already exists remotely (e.g. from a previous run), append -2, -3, etc. until you find a name that does not exist.

Step 3 — Apply fixes

Work through the To fix list one item at a time, in order from Critical → High → Medium → Low/Nits.

For each item:

• The item text describes the exact file, line, and change needed — follow it literally.
• After applying the change, do not commit yet.
• If a fix requires creating a new file (e.g. .env.local, vite-env.d.ts), create it.
• If a fix says "rotate key in dashboard" or describes any external/dashboard action with no in-repo code change, skip it and note it in the PR description — do not attempt to perform dashboard actions.
• If applying a fix would require information you don't have (e.g. a new API key value), substitute a clearly-marked placeholder like YOUR_NEW_API_KEY_HERE and note it in the PR description.

TomTom scope only. Only apply changes that are directly related to TomTom API usage, SDK configuration, API key handling, cost optimization, stability patterns, or MCP integration. Do not touch code for general quality reasons — do not remove comments, delete unused files or variables, reformat code, rename identifiers, or make structural refactors that are unrelated to TomTom. If an item in the TODO list looks like generic code cleanup rather than a TomTom-specific fix, skip it and note it in the PR description.

Step 4 — Verify the build

After all fixes are applied, run the project's build/type-check command. For this project: npm run build.

• If it passes: proceed.
• If it fails: diagnose the failure, fix it, and re-run. Only proceed once the build is clean.

Step 5 — Update AUDIT_TODO.md

Mark every item you fixed as checked (- [ ] → - [x]). For any item you skipped due to it being an external/dashboard action, add a note inline explaining why it was skipped rather than checking it off.

Step 6 — Commit

Stage all changed files explicitly (never git add . or git add -A — list the files). Commit with:

fix: apply TomTom audit findings from AUDIT_TODO.md

- <one line per fix applied, matching the severity and title from the TODO>

Manual actions still required:
- <one line per skipped item, e.g. "Rotate API key in TomTom Developer Dashboard">

Co-Authored-By: Claude Sonnet 4.6 <[e-mail]>

Step 7 — Update the GitHub issue

Look up the open audit issue:

gh issue list --search "title:\"TomTom Audit Findings\"" --state open --json number,title --limit 1

If an issue is found:

• Update its body with the full content of the now-updated AUDIT_TODO.md (checked items reflected):

  gh issue edit <number> --body "<content of AUDIT_TODO.md>"
  

• Record the issue number for use in Step 8.

If no issue is found or gh fails: skip silently, note it in the final report.

Step 8 — Push and open a pull request

Push the branch and open a PR:

git push -u origin <branch-name>
gh pr create --title "fix: TomTom audit findings" --body "<body>"

PR body format:

## Summary

Applies all actionable code fixes from the TomTom implementation audit.
Generated by `/tomtom-audit-report` and applied by `/tomtom-audit-fix`.

## Changes

- <bullet per fix applied, with file:line reference>

## Manual actions still required

- <bullet per skipped item — external/dashboard actions the fixer cannot automate>

## Closes

Closes #<issue-number>

Re-run `/tomtom-audit-report` after merging to confirm findings are resolved.

🤖 Generated with [Claude Code](https://claude.ai/claude-code)

If the issue number was not found in Step 7, omit the Closes #N line and replace it with "Addresses items in AUDIT_TODO.md."

If gh is not authenticated or there is no GitHub remote, push the branch and tell the user the PR could not be opened automatically — give them the gh pr create command to run themselves.

Step 9 — Report back

Tell the user:

• Branch name and PR URL (or why PR was skipped)
• Count of items fixed vs. skipped
• Any items that still require manual action (key rotations, dashboard changes, etc.)