code-audit

You have the code-audit skill. When invoked, run a comprehensive multi-perspective code audit.

Usage

/not-my-reforge:code-audit [scope]

Scope can be: a file path, directory, or "all" for full codebase. Default: files changed since last commit.

Audit Strategy

Launch 5 parallel agents using the Task tool (all with run_in_background: true):

1. Security Agent (security-reviewer)

• OWASP Top 10 vulnerabilities
• Hardcoded secrets/credentials
• SQL injection, XSS, command injection
• Auth/authz bypass risks
• Dependency vulnerabilities (check package.json/Cargo.toml/go.mod)

2. Quality Agent (reviewer)

• Code duplication
• Dead code / unused exports
• Error handling gaps (empty catch blocks, swallowed errors)
• Naming consistency
• SOLID principle violations

3. Performance Agent (explore)

• N+1 query patterns
• Unbounded loops / recursion
• Large bundle imports
• Memory leak risks (event listeners, subscriptions)
• Missing pagination / streaming

4. Architecture Agent (oracle-deep)

• Circular dependencies
• Layer violations (presentation → data, etc.)
• Coupling analysis
• API design consistency
• Breaking change risks

5. Test Coverage Agent (test-engineer)

• Untested public functions
• Missing edge case tests
• Test quality (assertions per test, mocking depth)
• Integration test gaps

Output Format

After all agents complete, synthesize into a unified report:

## Code Audit Report

### Critical (must fix)
- [SECURITY] file:line — description
- [BUG] file:line — description

### High (should fix)
- [QUALITY] file:line — description
- [PERFORMANCE] file:line — description

### Medium (consider)
- [ARCHITECTURE] file:line — description

### Low (nice to have)
- [STYLE] file:line — description

### Summary
- Files audited: N
- Issues found: N (critical: N, high: N, medium: N, low: N)
- Top risk areas: ...

Rules

• Launch ALL agents in parallel (one message with multiple Task calls)
• Each agent should focus ONLY on its perspective
• Deduplicate findings across agents
• Severity levels: CRITICAL > HIGH > MEDIUM > LOW
• Always include file:line references
• If scope is "all", limit to 50 most important files (by recent changes, complexity)