Audit

Name: Audit
Author: aiskillstore

aiskillstore/marketplace

2 installs
405 repo stars
Updated August 3, 2026
aiskillstore/marketplace

This is a copy of audit by cygnusfear - installs and ranking accrue to the original listing.

audit is a Claude Code skill that runs a systematic read-only codebase audit to report gaps, anti-patterns, type issues and code smells with severity.

About

audit performs a systematic read-only review of a codebase to surface quality issues, architectural anti-patterns and technical debt. It reviews files one by one, flags deprecations, TODOs, type issues and code smells, assigns severity, and writes a structured audit report. A developer uses it to find problems before refactoring or shipping, without editing code.

Runs a systematic, read-only codebase audit file by file
Flags deprecations, TODOs/FIXMEs, anti-patterns, type issues and code smells
Assigns severity and produces a structured audit report

Audit by the numbers

2 all-time installs (skills.sh)
Data as of Aug 3, 2026 (Skillselion catalog sync)

At a glance

audit capabilities & compatibility

Capabilities: code audit · code quality review · tech debt analysis
Use cases: code review · refactoring

From the docs

What audit says it does

Run comprehensive codebase audit for gaps, deprecated code, TODOs, FIXMEs, architectural anti-patterns, type issues, and code smells.

SKILL.md

**NEVER edit files during audit** - This is read-only analysis

SKILL.md

npx skills add https://github.com/aiskillstore/marketplace --skill audit

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/aiskillstore/marketplace/audit.svg)](https://skillselion.com/skills/aiskillstore/marketplace/audit)

Installs	2
repo stars	★ 405
Last updated	August 3, 2026
Repository	aiskillstore/marketplace ↗

What it does

Run a systematic read-only audit of a codebase to identify deprecations, anti-patterns, type issues and code smells with severity ratings.

Who is it for?

Finding code quality issues and technical debt across a codebase before refactoring.

Skip if: Fixing issues or writing action plans; it is read-only and reports only.

When should I use this skill?

A developer asks to audit code, find issues, or check code quality.

What you get

A structured report of issues by category and severity with file and line references.

structured markdown audit report
issues grouped by category and severity

By the numbers

5-phase audit process
4 severity levels (Critical, High, Medium, Low)
Top 10 critical findings summary

Files

SKILL.mdMarkdownGitHub ↗

Codebase Audit

Instructions

Perform a comprehensive, systematic audit of the codebase to identify quality issues, architectural problems, and technical debt.

Phase 1: Discovery & Planning

1. Identify scope - Determine which files/directories to audit based on user request 2. Create comprehensive file list - Use Glob to find all relevant files 3. Initialize todo list - Create a todo with one item per file to audit 4. Set up audit report - Create structured markdown report at .audit/audit-report-[timestamp].md

Phase 2: Automated Analysis

Run automated tools to supplement manual review:

TypeScript compiler diagnostics
ESLint (if configured)
Grep for common patterns: TODO, FIXME, HACK, XXX, @deprecated

Phase 3: Systematic File Review

For EACH file in the todo list:

1. Read and analyze the file thoroughly 2. Check for issues in these categories:

Deprecations: Deprecated APIs, patterns, or code marked for removal
TODOs/FIXMEs: Unfinished work or known issues
Architectural anti-patterns:
God objects/classes
Circular dependencies
Tight coupling
Violation of SOLID principles
Inconsistent patterns
Type issues:
Use of any or unknown
Missing type annotations
Incorrect type usage
Type casts that hide issues
Code smells:
Duplicated code
Long functions/classes
Complex conditionals
Dead code
Magic numbers/strings
Poor naming

3. Assign severity to each finding:

CRITICAL: Breaks functionality, security issues, data corruption risks
HIGH: Architectural violations, major maintainability issues
MEDIUM: Code smells, minor anti-patterns, missing types
LOW: Style issues, minor TODOs, cosmetic improvements

4. Check for cross-file patterns - As you review, note patterns that appear across multiple files

5. Update report - Add findings to the structured report

6. Mark file as completed in todo list

Phase 4: Cross-File Analysis

After reviewing all individual files:

1. Identify systemic patterns - Issues that appear across multiple files 2. Architectural assessment - Overall system architecture health 3. Dependency analysis - Check for circular dependencies or coupling issues 4. Consistency check - Verify naming conventions, patterns are followed

Phase 5: Validation & Summary

1. Run final checks:

TypeScript type check (tsc --noEmit or similar)
Linting (npm run lint or similar)
Build process if applicable

2. Generate executive summary:

Total issues by category
Total issues by severity
Top 10 most critical findings

Audit Report Structure

# Audit Report - [Date]

## Executive Summary
- **Files Audited**: X
- **Total Issues Found**: Y
- **Critical**: A | **High**: B | **Medium**: C | **Low**: D

## Top 10 Critical Findings
1. [Issue description] - Severity: CRITICAL - File: path/to/file.ts:line

## Issues by Category

### Deprecations
- [Issue] - Severity - File:line

### TODOs/FIXMEs
- [Issue] - Severity - File:line

### Architectural Anti-Patterns
- [Issue] - Severity - File:line

### Type Issues
- [Issue] - Severity - File:line

### Code Smells
- [Issue] - Severity - File:line

## Cross-File Patterns
- [Pattern description and affected files]

## Automated Tool Results
- TypeScript diagnostics summary
- ESLint results summary

Critical Principles

NEVER skip files - Audit every file in the todo list
NEVER edit files during audit - This is read-only analysis
NEVER provide recommendations - Only identify and report problems
NEVER create action plans - That's a separate responsibility
DO use memory/pinboard - Store context as you discover patterns
DO be thorough - Think critically about each file
DO be objective - Report what you find, not what to do about it
DO track progress - Keep todo list updated in real-time
DO find all relevant files - If you discover new files that should be audited, add them to the todo

Dynamic File Discovery

If during audit you discover additional files that should be reviewed: 1. Add them to the todo list immediately 2. Continue systematic review 3. Ensure no stone is left unturned

{
  "schema_version": "2.0",
  "meta": {
    "generated_at": "2026-01-16T22:52:51.523Z",
    "slug": "cygnusfear-audit",
    "source_url": "https://github.com/Cygnusfear/claude-stuff/tree/main/skills/audit",
    "source_ref": "main",
    "model": "claude",
    "analysis_version": "3.0.0",
    "source_type": "community",
    "content_hash": "eceb7120b921d4e8735cc61057cb22d1cd004d21d5994e6e42b6a4cf47723f3c",
    "tree_hash": "286e6a65fe99158fb1f5d09b0d8b84015bc5c7ef651633f2633e9de3c35aca55"
  },
  "skill": {
    "name": "audit",
    "description": "Run comprehensive codebase audit for gaps, deprecated code, TODOs, FIXMEs, architectural anti-patterns, type issues, and code smells. Use when user asks to audit code, find issues, check code quality, or identify architectural problems.",
    "summary": "Run comprehensive codebase audit for gaps, deprecated code, TODOs, FIXMEs, architectural anti-patter...",
    "icon": "🔍",
    "version": "1.0.0",
    "author": "Cygnusfear",
    "license": "MIT",
    "category": "coding",
    "tags": [
      "code-quality",
      "audit",
      "code-review",
      "technical-debt",
      "static-analysis"
    ],
    "supported_tools": [
      "claude",
      "codex",
      "claude-code"
    ],
    "risk_factors": [
      "network",
      "external_commands"
    ]
  },
  "security_audit": {
    "risk_level": "safe",
    "is_blocked": false,
    "safe_to_publish": true,
    "summary": "Pure prompt-based skill containing only markdown instructions for systematic code audit methodology. Contains no executable code, network calls, or file system modifications. The static analyzer flagged benign content (documentation, command references, and metadata) as false positives. All 17 detected patterns are harmless - this is a read-only analysis tool.",
    "risk_factor_evidence": [
      {
        "factor": "network",
        "evidence": [
          {
            "file": "skill-report.json",
            "line_start": 6,
            "line_end": 6
          }
        ]
      },
      {
        "factor": "external_commands",
        "evidence": [
          {
            "file": "SKILL.md",
            "line_start": 17,
            "line_end": 17
          },
          {
            "file": "SKILL.md",
            "line_start": 41,
            "line_end": 41
          },
          {
            "file": "SKILL.md",
            "line_start": 41,
            "line_end": 41
          },
          {
            "file": "SKILL.md",
            "line_start": 77,
            "line_end": 77
          },
          {
            "file": "SKILL.md",
            "line_start": 78,
            "line_end": 78
          },
          {
            "file": "SKILL.md",
            "line_start": 88,
            "line_end": 122
          }
        ]
      }
    ],
    "critical_findings": [],
    "high_findings": [],
    "medium_findings": [],
    "low_findings": [],
    "dangerous_patterns": [],
    "files_scanned": 2,
    "total_lines": 319,
    "audit_model": "claude",
    "audited_at": "2026-01-16T22:52:51.522Z"
  },
  "content": {
    "user_title": "Audit codebase for quality issues",
    "value_statement": "Codebases accumulate technical debt, deprecated patterns, and hidden bugs over time. This skill provides a systematic framework for comprehensive code review that identifies problems across deprecations, architecture, types, and code smells.",
    "seo_keywords": [
      "code audit",
      "codebase review",
      "code quality",
      "technical debt",
      "static analysis",
      "Claude Code audit",
      "code smell detection",
      "deprecated code finder",
      "architectural review",
      "type checking"
    ],
    "actual_capabilities": [
      "Scans for deprecated APIs and patterns marked for removal",
      "Identifies TODOs, FIXMEs, and HACK comments indicating unfinished work",
      "Detects architectural anti-patterns like circular dependencies and god objects",
      "Flags type issues including any/unknown usage and missing annotations",
      "Reports code smells such as duplication, long functions, and magic numbers",
      "Runs TypeScript compiler and ESLint diagnostics for automated analysis"
    ],
    "limitations": [
      "Does not fix issues or modify code during the audit",
      "Does not provide remediation recommendations or action plans",
      "Does not execute arbitrary commands beyond standard dev tools",
      "Requires user to specify or discover the scope of files to audit"
    ],
    "use_cases": [
      {
        "target_user": "Engineering Managers",
        "title": "Assess codebase health",
        "description": "Evaluate technical debt and code quality before refactoring sprints or architecture reviews"
      },
      {
        "target_user": "Security Auditors",
        "title": "Find risky patterns",
        "description": "Identify deprecated security patterns and anti-patterns that may introduce vulnerabilities"
      },
      {
        "target_user": "Developers",
        "title": "Prepare for code review",
        "description": "Systematically review pull requests and identify issues before team review"
      }
    ],
    "prompt_templates": [
      {
        "title": "Quick audit",
        "scenario": "Basic audit request",
        "prompt": "Run a quick audit on the files in src/components/"
      },
      {
        "title": "Full codebase audit",
        "scenario": "Complete review",
        "prompt": "Perform a comprehensive audit of the entire codebase including all TypeScript files"
      },
      {
        "title": "Security-focused audit",
        "scenario": "Security assessment",
        "prompt": "Audit the codebase specifically looking for deprecated security patterns and type vulnerabilities"
      },
      {
        "title": "Architecture review",
        "scenario": "Architectural assessment",
        "prompt": "Audit the codebase for architectural anti-patterns, circular dependencies, and SOLID violations"
      }
    ],
    "output_examples": [
      {
        "input": "Audit the utils directory for issues",
        "output": [
          "Found 12 files to audit in the utils directory",
          "3 deprecations using Buffer() instead of Buffer.from()",
          "5 FIXME comments indicating known bugs",
          "2 functions exceeding 100 lines of code",
          "4 uses of 'any' type hiding potential bugs",
          "1 instance of god object in DateHelper.ts"
        ]
      },
      {
        "input": "Run a security-focused audit on the auth module",
        "output": [
          "Audited 8 files in the auth module",
          "Found 2 uses of deprecated crypto methods",
          "Identified 1 hardcoded secret in config file",
          "Detected 3 instances of missing input validation",
          "Report saved to .audit/audit-report-[timestamp].md"
        ]
      }
    ],
    "best_practices": [
      "Specify clear scope upfront to avoid missing relevant files during audit",
      "Use pinboard to track cross-file patterns as you discover them",
      "Review automated tool results (tsc, eslint) alongside manual analysis"
    ],
    "anti_patterns": [
      "Skipping files because they seem straightforward at first glance",
      "Editing or fixing code during the audit instead of just reporting findings",
      "Providing recommendations instead of focusing on objective findings"
    ],
    "faq": [
      {
        "question": "What file types can this skill audit?",
        "answer": "The skill works with any text-based files. It is optimized for TypeScript, JavaScript, and common web languages."
      },
      {
        "question": "Does this skill modify my codebase?",
        "answer": "No. The skill explicitly operates in read-only mode and does not edit, delete, or create files in your codebase."
      },
      {
        "question": "Can I run this skill in CI/CD pipelines?",
        "answer": "This is a Claude Code skill designed for interactive use. For automated pipelines, use tsc, eslint, and dedicated CI tools."
      },
      {
        "question": "How long does a full codebase audit take?",
        "answer": "Time varies by codebase size. The skill uses a todo list to track progress and works systematically through each file."
      },
      {
        "question": "Does this skill access my environment variables?",
        "answer": "No. The skill only reads files you specify and runs standard dev tools like tsc and eslint that you already have installed."
      },
      {
        "question": "How is this different from running eslint alone?",
        "answer": "This skill performs deeper analysis including architectural patterns, cross-file dependencies, and issues that automated tools may miss."
      }
    ]
  },
  "file_structure": [
    {
      "name": "SKILL.md",
      "type": "file",
      "path": "SKILL.md",
      "lines": 142
    }
  ]
}