Comprehensive Codebase Auditor

The Problem

Codebases tend to accumulate architecture drift, duplicated code, exposed secrets, and thin test coverage as features land. Manual review often stays inside a single function, while refactoring or security work needs a shared, repeatable view of the system. This skill turns a repository check into an audit-style deliverable: a prioritized issue list with severity and recommended action.

How It Works

The audit covers six dimensions:
- Architecture: module boundaries, dependency relationships, and coupling
- Code quality: naming conventions, duplicated code, and complexity
- Security: injection risks, weak authorization controls, and sensitive-data exposure
- Performance: inefficient queries, memory leaks, and unnecessary synchronization
- Testing: unit-test coverage and coverage of critical paths
- Maintainability: documentation completeness and change impact surface

It relies on read and exec to inspect repository content and run the checks needed for the audit. The output is usually structured like an engineering backlog: critical findings such as SQL concatenation or hard-coded tokens, moderate items such as missing input validation or circular dependencies, and lower-priority items such as low test coverage or overly long functions.

Boundaries

This is best used for pre-refactoring assessment, technical-debt triage, and an initial security review. It is not a replacement for a full SAST pipeline, performance load testing, or compliance auditing. For regulated systems, pair it with dedicated security scanners, architecture review, and a maintained testing strategy.