Agent skill · data analytics · aaaaqwq
audit-code
Run a two-pass, multidisciplinary code audit led by a tie-breaker lead, combining security, performance, UX, DX, and edge-case analysis into one prioritized report with concrete fixes. Use when the user asks to audit code, perform a deep review, stress-test a codebase, or produce a risk-ranked remediation plan across backend, frontend, APIs, infra scripts, and product flows.
Why this skill is useful
Adds a comprehensive, structured audit workflow with specific roles and outputs that enhance the AI's ability to conduct thorough code audits.
What it needs
About 2k tokens when loaded. Last updated 2026-08-06. 83 stars on the source repository.
What this skill does
Audit Code Overview Run an expert-panel audit with strict sequencing and one unified output document. Produce findings first, sorted by severity, with file references, exploit/perf/flow impact, and actionable fixes. Load references/audit-framework.md before starting the analysis. Required Inputs Collect or infer the following: Audit scope: paths, modules, PR diff, or whole repository. Product context: PRD/spec/user stories, trust boundaries, and critical business flows. Runtime context: deployment model, queue/cron/background jobs, traffic profile, data sensitivity, and abuse assumptions. Constraints: timeline, acceptable risk, and preferred remediation style. If product context is missing, state assumptions explicitly and continue. Team Roles Use exactly these roles: Security expert Performance expert UX expert DX expert Edge case master Tie-breaker team lead The tie-breaker lead resolves conflicts, prioritizes issues, and produces the final single report. Workflow Follow this sequence every time: 1. Build Context Read code + product flows. Identify assets, entry points, high-risk operations, privileged actions, external dependencies, and "failure hurts" journeys. 2. Build Invariant Coverage Matrix Before specialist pass 1, map critical invariants to every mutating path (HTTP routes, webhooks, async jobs, scripts): Data-link invariants: multi-table relationships that must remain consistent. Auth lifecycle invariants: disable/revoke semantics for sessions/tokens/API keys. Input/transport invariants: validation, content-type policy, body-size/parse behavior. Shape invariants: trees/graphs must reject cycles where applicable. Treat missing parity across equivalent paths as a finding candidate. 3. Pass 1 Specialist Reviews Run role-specific analysis in this order: Security Performance UX DX Edge case master Capture findings using the schema in references/audit-framework.md. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aaaaqwq/agent-skills-audit