Treasures

Scan the current project for security vulnerabilities, code quality issues, dead code, and hidden oddities. Output a severity-ranked report.

Important

• Scan the ENTIRE project unless $ARGUMENTS specifies a scope (e.g., auth/, src/api/)
• Never modify any files. This is a read-only audit
• Rank every finding by severity: CRITICAL, HIGH, MEDIUM, LOW, INFO, FUN
• Be specific — include file paths and line numbers for every finding
• Do not report style issues (formatting, naming). Focus on correctness and security
• False positives are worse than missed findings. Only report things you are confident about

Instructions

Step 1: Map the project

Read the project structure. Identify:

• Language/framework (package.json, requirements.txt, go.mod, Cargo.toml, etc.)
• Entry points (main files, route definitions, CLI entry)
• Configuration files (.env.example, config/, settings files)
• Test directories

Step 2: Security scan

Search for these patterns across the codebase:

CRITICAL / HIGH:

• Auth bypass flags or backdoors (bypass, skip_auth, admin.*true, debug.*mode.*prod)
• Hardcoded secrets, API keys, passwords (password\s*=, secret\s*=, api_key\s*=, token\s*= with actual values)
• SQL injection vectors (string concatenation in queries, f-strings in SQL)
• Command injection (exec(, eval(, child_process.exec with user input)
• Unauthenticated endpoints that should require auth
• Deprecated crypto (MD5, SHA1 for authentication/signing, DES)
• Permissive CORS (Access-Control-Allow-Origin: * on authenticated endpoints)
• Missing rate limiting on auth endpoints

MEDIUM:

• Secrets in example/template files (.env.example with real values)
• Hidden feature flags (DARK_LAUNCH, FEATURE_FLAG, BETA)
• Overly permissive file permissions in scripts
• Missing input validation on user-facing endpoints
• Unencrypted sensitive data in logs

LOW / INFO:

• Dead routes (defined but no callers)
• Unused exports/functions (exported but never imported elsewhere)
• TODO/HACK/FIXME comments that indicate known issues
• Commented-out code blocks (>10 lines)
• Stale dependencies (check for known-vulnerable versions if lockfile exists)

FUN:

• Easter eggs, hidden messages, joke comments
• Unusual file names or directories

Step 3: Dead code detection

Search for:

• Exported functions/classes never imported by other files
• Route handlers with no corresponding client calls (if both client and server are in repo)
• Config values defined but never read
• Test files for deleted source files

Step 4: Compile report

Output findings in this format:

TREASURES — [project-name] — [N] findings

CRITICAL ([count])
  * [file:line] [description]
    Evidence: [the matching code or pattern]
    Risk: [what could go wrong]

HIGH ([count])
  * [file:line] [description]
    ...

MEDIUM ([count])
  ...

LOW ([count])
  ...

INFO ([count])
  ...

FUN ([count])
  ...

SUMMARY: [1-2 sentence overall assessment]

Step 5: Offer next steps

After the report, offer:

• "Fix critical/high issues now" — walk through fixes one at a time
• "Create GitHub issues for HIGH+" — generate issue descriptions (if gh CLI available)
• "Re-scan [specific area]" — deeper dive into a flagged area

Error Handling

1. No source code found: Report "No scannable source files found in [path]. Is this the right directory?"
2. Scope argument doesn't exist: Report "Directory $ARGUMENTS not found. Available top-level directories: [list]"
3. Very large project (>1000 files): Scan top-level structure first, then focus on the most likely areas (auth, API, config, database)

Examples

Example 1: Full project scan

Input: /code-security Process: Scans entire project, finds 3 HIGH issues in auth module, 2 MEDIUM in config, 1 FUN easter egg Output: Severity-ranked report with file:line references

Example 2: Scoped scan

Input: /code-security src/auth/ Process: Deep scan of auth directory only Output: Focused report on auth-related findings

Example 3: Clean project

Input: /code-security Output: "TREASURES — acme-api — 0 critical/high findings. 2 LOW items (stale TODOs). Looking solid."