Audit Orchestrator

Audit Orchestrator

Run a structured audit by dispatching specialized audit agents in parallel.

Scope: Parse the user's request to determine scope and parameters. Accepted values: frontend, backend, infra, security, all (default: all).

Dispatch Rules

Based on scope, use spawn_agent to launch the appropriate audit agents in parallel. Use wait_agent / wait to collect results:

Only dispatch agents that exist in the project's skills directory. Skip unavailable agents with a note.

Execution Steps

1. Determine scope from the user's request (default: all)

2. Detect project structure to tailor audit scope:

   • Scan for go.mod, package.json, pyproject.toml, Cargo.toml, docker-compose.yml
   • Map detected stacks to relevant audit agents

3. Launch agents in parallel — use spawn_agent to dispatch all relevant agents simultaneously:

   • audit-frontend — UI/UX checks: hardcoded values, console.log, TypeScript strict, query patterns, accessibility, bundle size
   • audit-backend — API/logic checks: SQL safety, error handling, PII leaks, auth gaps, input validation, stubs
   • audit-infra — Infrastructure checks: Docker security, exposed ports, env secrets, health checks, resource limits
   • security-scanner — Cross-cutting security: OWASP top-10, secrets in code, dependency vulnerabilities, auth bypass, CORS, rate limiting

4. Collect results from all agents using wait_agent / wait

5. Merge and deduplicate — if the same file:line flagged by multiple agents, keep highest severity

6. Output unified report

Agent Prompt Template

For each agent, send this prompt:

Run ALL checks from your checklist against the project codebase.
Scope: {scope}
Report every check as PASS/WARN/FAIL with evidence.
End with summary counts and action items for FAILs.

Output Format

After collecting all agent results, produce a unified report:

## Audit Report
Scope: {scope}
Date: {date}
Agents: {list of dispatched agents}

### Frontend (audit-frontend)
[results from agent, or "Skipped — no frontend detected / agent unavailable"]

### Backend (audit-backend)
[results from agent, or "Skipped — no backend detected / agent unavailable"]

### Infrastructure (audit-infra)
[results from agent, or "Skipped — agent unavailable"]

### Security (security-scanner)
[results from agent]

### Grand Summary
| Agent | PASS | WARN | FAIL |
|-------|------|------|------|
| frontend | X | Y | Z |
| backend | X | Y | Z |
| infra | X | Y | Z |
| security | X | Y | Z |
| **Total** | **X** | **Y** | **Z** |

### Critical Action Items (FAILs only)
1. [agent] file:line — description
2. ...

Notes

• All agents run in parallel — audit completes much faster than sequential
• Each agent has its own context window — no pollution of main conversation
• Overlapping checks (e.g., SQL injection in both backend and security) are deduplicated
• For targeted re-audit after fixes, specify a narrower scope