Codebase Audit
Core Insight: Different domains need different lenses. A security audit looks for injection; a UX audit looks for confusion. Same codebase, different questions.
When to Use What
| Need |
Skill |
| Find and report domain-specific issues |
codebase-audit (this) |
| Find bugs and fix them iteratively |
multi-pass-bug-hunting |
| Evaluate usability specifically |
ux-audit |
| Make UI visually polished |
ui-polish |
THE EXACT PROMPT
Perform a comprehensive [DOMAIN] audit of this codebase.
Domain: security | ux | performance | api | copy | cli
Return a detailed report with:
- File path and line numbers for each issue
- Severity (Critical/High/Medium/Low)
- Root cause analysis
- Recommended fix
Use the output template and domain checklist from references.
Quick Multi-Domain Sweep
Run quick audits across: security, performance, api
For each domain: top 3 issues only, with severity and fix.
Total output under 100 lines.
Domains at a Glance
| Domain |
Key Question |
Top Signals |
| security |
Can attackers exploit this? |
injection, auth bypass, secrets in code |
| ux |
Is this confusing? |
accessibility, error handling, flows |
| performance |
Is this slow? |
N+1 queries, blocking I/O, missing cache |
| api |
Is this pleasant to consume? |
status codes, error format, pagination |
| copy |
Is this clear? |
jargon, tone, error messages |
| cli |
Is this discoverable? |
--help, exit codes, progress feedback |
Full checklists: CHECKLISTS.md
Output Template
# [Domain] Audit Report: [Project]
## Summary
- **Total:** N findings
- **Critical:** X | **High:** Y | **Medium:** Z | **Low:** W
## Critical Findings
### [Title]
- **Location:** `file.rs:42`
- **Issue:** [What's wrong]
- **Root Cause:** [Why]
- **Fix:** [Solution]
## High / Medium / Low
[Same format, decreasing detail]
Severity
| Level |
Criteria |
Example |
| Critical |
Exploitable now, data loss |
SQL injection, unauth admin |
| High |
Serious, harder to exploit |
CSRF missing, N+1 on hot path |
| Medium |
Real issue, limited scope |
Missing validation, vague errors |
| Low |
Polish, best practice |
Naming inconsistency, missing docs |
codebase-audit vs multi-pass-bug-hunting
| Aspect |
codebase-audit |
multi-pass-bug-hunting |
| Goal |
Find and report |
Find and fix |
| Output |
Severity-rated report |
Fixed code |
| Loop |
One-shot exploration |
Iterative convergence |
| Domains |
Parameterized by domain |
Generic bugs |
| Use case |
Assessment, planning |
Pre-release hardening |
Workflow Integration
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ codebase-audit │────▶│ Create beads for │────▶│ multi-pass-bug │
│ (find + report) │ │ critical issues │ │ hunting (fix) │
└─────────────────┘ └──────────────────┘ └─────────────────┘
# After audit, create issues
br create --title="[Security] SQL injection in user_search" \
--type=bug --priority=0 --body="Found at src/search.rs:42"
Quick Grep Patterns
Security
rg -n "unwrap\(\)|panic!" --type rust # Rust panics
rg -n "eval\(|exec\(" --type js --type py # Code injection
rg -n "password|secret|api_key" --type-not lock # Hardcoded secrets
Performance
rg -n "for.*await|\.await.*for" --type rust # Async in loops
rg -n "SELECT.*FROM.*WHERE" | grep -v "LIMIT" # Unbounded queries
CLI
./tool --help | head -20 # Help exists?
./tool --unknown 2>&1; echo "Exit: $?" # Error handling
More patterns: TOOLS.md
Anti-Patterns
| Don't |
Do |
| "code is bad" |
Specific file:line + fix |
| Mix severities |
Group by impact |
| Audit everything at once |
One domain, deep |
| Skip root cause |
Explain WHY, not just WHAT |
| Report-only |
Create issues for criticals |
References
| Topic |
File |
| Full domain checklists |
CHECKLISTS.md |
| Example audit reports |
EXAMPLES.md |
| Tool commands by domain |
TOOLS.md |
1---2name: codebase-audit3description: Domain-parameterized codebase auditing (security, UX, performance, API, copy, CLI). Use when auditing code, assessing quality, finding issues, or pre-launch review.4---56<!-- TOC: Core | Prompt | Domains | Output | Severity | Integration | Anti-Patterns | References -->78# Codebase Audit910> **Core Insight:** Different domains need different lenses. A security audit looks for injection; a UX audit looks for confusion. Same codebase, different questions.1112## When to Use What1314| Need | Skill |15|------|-------|16| Find and **report** domain-specific issues | **codebase-audit** (this) |17| Find bugs and **fix them iteratively** | multi-pass-bug-hunting |18| Evaluate **usability** specifically | ux-audit |19| Make UI **visually polished** | ui-polish |2021---2223## THE EXACT PROMPT2425```26Perform a comprehensive [DOMAIN] audit of this codebase.2728Domain: security | ux | performance | api | copy | cli2930Return a detailed report with:31- File path and line numbers for each issue32- Severity (Critical/High/Medium/Low)33- Root cause analysis34- Recommended fix3536Use the output template and domain checklist from references.37```3839### Quick Multi-Domain Sweep4041```42Run quick audits across: security, performance, api4344For each domain: top 3 issues only, with severity and fix.45Total output under 100 lines.46```4748---4950## Domains at a Glance5152| Domain | Key Question | Top Signals |53|--------|--------------|-------------|54| **security** | Can attackers exploit this? | injection, auth bypass, secrets in code |55| **ux** | Is this confusing? | accessibility, error handling, flows |56| **performance** | Is this slow? | N+1 queries, blocking I/O, missing cache |57| **api** | Is this pleasant to consume? | status codes, error format, pagination |58| **copy** | Is this clear? | jargon, tone, error messages |59| **cli** | Is this discoverable? | --help, exit codes, progress feedback |6061Full checklists: [CHECKLISTS.md](references/CHECKLISTS.md)6263---6465## Output Template6667```markdown68# [Domain] Audit Report: [Project]6970## Summary71- **Total:** N findings72- **Critical:** X | **High:** Y | **Medium:** Z | **Low:** W7374## Critical Findings7576### [Title]77- **Location:** `file.rs:42`78- **Issue:** [What's wrong]79- **Root Cause:** [Why]80- **Fix:** [Solution]8182## High / Medium / Low83[Same format, decreasing detail]84```8586---8788## Severity8990| Level | Criteria | Example |91|-------|----------|---------|92| **Critical** | Exploitable now, data loss | SQL injection, unauth admin |93| **High** | Serious, harder to exploit | CSRF missing, N+1 on hot path |94| **Medium** | Real issue, limited scope | Missing validation, vague errors |95| **Low** | Polish, best practice | Naming inconsistency, missing docs |9697---9899## codebase-audit vs multi-pass-bug-hunting100101| Aspect | codebase-audit | multi-pass-bug-hunting |102|--------|----------------|------------------------|103| **Goal** | Find and **report** | Find and **fix** |104| **Output** | Severity-rated report | Fixed code |105| **Loop** | One-shot exploration | Iterative convergence |106| **Domains** | Parameterized by domain | Generic bugs |107| **Use case** | Assessment, planning | Pre-release hardening |108109---110111## Workflow Integration112113```114┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐115│ codebase-audit │────▶│ Create beads for │────▶│ multi-pass-bug │116│ (find + report) │ │ critical issues │ │ hunting (fix) │117└─────────────────┘ └──────────────────┘ └─────────────────┘118```119120```bash121# After audit, create issues122br create --title="[Security] SQL injection in user_search" \123 --type=bug --priority=0 --body="Found at src/search.rs:42"124```125126---127128## Quick Grep Patterns129130### Security131```bash132rg -n "unwrap\(\)|panic!" --type rust # Rust panics133rg -n "eval\(|exec\(" --type js --type py # Code injection134rg -n "password|secret|api_key" --type-not lock # Hardcoded secrets135```136137### Performance138```bash139rg -n "for.*await|\.await.*for" --type rust # Async in loops140rg -n "SELECT.*FROM.*WHERE" | grep -v "LIMIT" # Unbounded queries141```142143### CLI144```bash145./tool --help | head -20 # Help exists?146./tool --unknown 2>&1; echo "Exit: $?" # Error handling147```148149More patterns: [TOOLS.md](references/TOOLS.md)150151---152153## Anti-Patterns154155| Don't | Do |156|-------|-----|157| "code is bad" | Specific `file:line` + fix |158| Mix severities | Group by impact |159| Audit everything at once | One domain, deep |160| Skip root cause | Explain WHY, not just WHAT |161| Report-only | Create issues for criticals |162163---164165## References166167| Topic | File |168|-------|------|169| Full domain checklists | [CHECKLISTS.md](references/CHECKLISTS.md) |170| Example audit reports | [EXAMPLES.md](references/EXAMPLES.md) |171| Tool commands by domain | [TOOLS.md](references/TOOLS.md) |
lev-os