code-auditor_skill

Overview

This skill performs a comprehensive codebase analysis across architecture, code quality, security, performance, testing, and maintainability. It produces prioritized findings, file:line references where possible, and a practical action plan to reduce technical debt and improve code health. Use configurable thoroughness levels from quick checks to deep audits.

How this skill works

The auditor explores the repository to map structure and dependencies, locates relevant files with glob and grep, and reads critical sources for context. Static analysis tools, linters, and coverage reports are executed when available, then findings are synthesized into a clear, prioritized report with remediation steps and estimated effort. Reports include metrics (files analyzed, LOC, coverage, complexity hotspots).

When to use it

• Before a major release to assess risks and technical debt
• When onboarding a new team or handing off a project
• To find security vulnerabilities and OWASP-related issues
• When test coverage or CI failures are a concern
• To optimize performance hotspots and database queries

Best practices

• Run a quick audit before each release and a deep audit quarterly
• Provide repository access to enable linters and coverage tools to run
• Focus remediation on critical/high issues first, then medium-term items
• Include maintainability metrics in sprint planning and PR reviews
• Use the audit to create concrete tickets with estimated effort

Example use cases

• Full health check for legacy code to plan refactoring and roadmap items
• Security-only scan to find authentication, authorization, and secrets issues
• Performance-focused audit to identify algorithmic or DB bottlenecks
• Testing assessment to locate missing scenarios and improve coverage
• Pre-merge review to catch architectural regressions and code smells