From grimoire
Discovers @audit annotations in codebases using grep for all languages and tree-sitter for Rust/Solidity context resolution. Outputs file/line/tag/content as filterable JSON or tables.
npx claudepluginhub joranhonig/grimoireThis skill uses the workspace's default tool permissions.
Find `@audit` annotations in a codebase and return them as structured JSON.
Annotates code using @ai- prefixed markers for technical debt, security vulnerabilities, performance bottlenecks, and accessibility issues to enable AI-assisted workflows.
Guides writing ast-grep rules for AST-based structural code search to find patterns like unhandled async functions or specific constructs beyond text matching.
Maps codebase structure, patterns, symbols, and dependencies using ast-grep and bash scripts. Outputs factual maps with paths/line numbers to .artifacts/research/.
Share bugs, ideas, or general feedback.
Find @audit annotations in a codebase and return them as structured JSON.
src/ subdirectory, or whatever the user specified.uv run skills/annotation/scripts/find-annotations.py <directory> [--tag TAG] [--format json|table]
directory — path to scan (usually the project root or src/)--tag — filter to a specific tag, exact match (e.g., audit-high, audit-todo)--format — json (default) or table for human-readable outputEach annotation is returned with six fields:
| Field | Description |
|---|---|
file | Relative path from the scanned directory |
line | Line number (1-indexed) |
tag | Tag name — audit, audit-ok, audit-high, audit-todo, etc. |
content | Text after the tag on the same line |
context_type | Enclosing scope type (function, contract, trait, etc.) or unknown |
context_name | Name of the enclosing scope or unknown |
The script has two tiers of support:
unknown.context_type and context_name to the enclosing function, contract, trait, impl, or module. Falls back to grep if tree-sitter dependencies are not installed.Refer to references/annotation-format.md for the full taxonomy of supported @audit tag types.