/audit - Multi-Agent Code Audit

Run a comprehensive audit that combines security, performance, architecture, and dependency analysis in one pass.

Target: $ARGUMENTS

When to Use

• Before a production release
• After a major refactor
• During compliance reviews (SOC2, ISO 27001)
• When onboarding to an unfamiliar codebase
• When technical debt feels unmanageable
• NOT for: single-file reviews (use @reviewer instead)

Workflow

Step 1: Scope Definition

Determine audit scope:

IF $ARGUMENTS is a path → audit that path
IF $ARGUMENTS is a module name → find and audit the module
IF $ARGUMENTS is empty → audit entire project

Read the project structure. Identify:

• Total files and lines of code
• Primary language and framework
• Test coverage indicators
• CI/CD configuration

Step 2: Security Audit

Check for OWASP Top 10 vulnerabilities:

Run if available:

npm audit --json 2>/dev/null || true
npx eslint --format json $TARGET 2>/dev/null || true

Step 3: Architecture Audit

Check structural integrity:

Step 4: Performance Audit

Check for performance issues:

Step 5: Dependency Audit

Check dependency health:

Run if available:

npx depcheck --json 2>/dev/null || true

Step 6: Report Generation

Compile findings into a structured report with severity ratings.

Severity Levels

Verification Protocol

Before claiming audit is complete:

1. All 4 audit domains were checked (security, architecture, performance, dependencies)
2. Every finding has a severity level
3. Every CRITICAL/HIGH finding has a specific remediation step
4. Automated tools were run where available (npm audit, eslint, depcheck)
5. Report includes line-level references for each finding

Anti-Rationalization

Rules

1. Check all 4 domains - Skipping one defeats the purpose
2. Run automated tools - Never skip npm audit or linting if available
3. Severity must be justified - Every rating needs evidence
4. Remediation is required - Findings without fix suggestions are useless
5. Line references are required - Point to exact files and lines
6. Never assume safety - Verify, don't trust

Output

──── /audit ────
Target: [path or module]
Scope: [X files, Y lines]

Security:     [X critical, Y high, Z medium]
Architecture: [X high, Y medium]
Performance:  [X high, Y medium]
Dependencies: [X vulnerable, Y outdated, Z unused]

Overall Score: [0-100]
Risk Level: [CRITICAL | HIGH | MEDIUM | LOW]

Top Findings:
1. [CRITICAL] [description] - [file:line]
2. [HIGH] [description] - [file:line]
3. [HIGH] [description] - [file:line]

Full report: [inline below]