audit

name	audit
description	Use when asked to audit a codebase, or when the /audit command runs — find security, correctness, and quality issues across a project and report them organized by severity.

Code Audit

Audit the current project for security, correctness, and quality issues. Work through the codebase systematically rather than sampling files.

Procedure

1. Identify the project structure, entry points, and external attack surface (network input, file input, shell commands).
2. Scan for common issue classes:
   • Security: injection (command/shell, path traversal), secrets in code, unsafe deserialization, missing auth/authorization, TLS misuse, dependency vulnerabilities (lockfile advisories).
   • Correctness: race conditions, error paths swallowing failures, off-by-one / boundary errors, resource leaks (handles, sockets), unhandled promise rejections.
   • Quality: dead code, duplicated logic, missing validation at boundaries, poor error messages, missing tests for critical paths.
3. Verify suspicions against the actual code — cite file paths and line-level evidence.
4. Report findings organized by severity (critical / high / medium / low), each with: location, what's wrong, why it matters, and a concrete fix suggestion.
5. End with a short "healthy areas" note so the audit is balanced.

Constraints

• Do not modify code during the audit — findings only.
• If the project is small or has no security surface, say so explicitly instead of padding the report.