# Code Quality Audit

> Run a comprehensive code quality audit covering security, performance, and maintainability. Use for quarterly audits, pre-release reviews, or when onboarding to a large codebase.

- Skill: `davila7/code-quality-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add davila7/code-quality-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/davila7/code-quality-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: davila7 (https://skillmd.com/u/davila7)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/davila7/code-quality-audit

---


Run a comprehensive code quality audit of this codebase.

## Audit areas

Investigate each area systematically. Search broadly before drawing conclusions — read files, grep for patterns, and check multiple directories.

### Security

Look for common security issues:

- Hardcoded secrets: search for `password=`, `api_key=`, `secret=`, `token=` followed by a literal string value in non-test, non-example files
- SQL injection vectors: string concatenation or f-strings/template literals that embed variables directly into SQL query strings
- XSS: direct `innerHTML` assignment in JavaScript or TypeScript files without sanitization
- Insecure defaults: `DEBUG=True`, `CORS allow *`, `verify=False` in requests calls, `NODE_ENV` not set to production in deployment config

### Performance

Look for patterns that commonly cause performance problems:

- N+1 query patterns: a database call inside a loop
- Synchronous operations that could be async: blocking I/O in a path that handles concurrent requests
- Large files read entirely into memory: `fs.readFileSync`, `open().read()` on files that are not guaranteed to be small

### Maintainability

- Functions over 50 lines: read source files and estimate function lengths
- Files over 300 lines: use `find . -name "*.py" -o -name "*.ts" -o -name "*.js" | xargs wc -l | sort -rn | head -20` (exclude node_modules, dist, .git)
- Deeply nested conditionals: more than 4 levels of if/for/while nesting
- Magic numbers: numeric literals used directly in conditions without a named constant

### Dependencies

Read `package.json`, `requirements.txt`, or `go.mod`. Note:
- Packages listed as deprecated in their README or comments in the file
- Packages with obvious CVE mentions in README or lock file comments
- Packages pinned to very old major versions (e.g., a major version more than 2 behind current)

## Output format

Return a structured report with these sections:

**Executive summary** — three bullet points covering the most important findings across all areas.

**Findings by area** — for each area (Security, Performance, Maintainability, Dependencies):
- Critical: must fix before release
- Warning: should fix soon
- Suggestion: worth addressing when time permits

Each finding must include a specific `file:line` reference. Do not list findings without a location.

**Top 3 recommended fixes** — the three findings that would have the greatest positive impact, in priority order, with a brief rationale for each.

If an audit area has no findings, state "No issues found" for that area rather than omitting it.