Code Audit
Perform comprehensive code audits and generate structured markdown reports.
Workflow
- Scope: Determine target (full repo, specific path, or focused concern)
- Discovery: List and categorize source files
- Analysis: Evaluate each category systematically
- Report: Generate markdown report using template format
- GitHub Issues: Create issues using
scripts/create_issue.sh:
- First: Create individual issues for each actionable recommendation
- Then: Create the full audit report with subtasks linking to each issue
Analysis Categories
| Category |
What to Look For |
| Architecture |
Separation of concerns, component structure, dependencies |
| Bugs |
Race conditions, null checks, resource leaks, edge cases |
| SOLID Violations |
SRP (god classes), OCP, LSP, ISP, DIP issues |
| DRY Violations |
Duplicated logic, repeated patterns, copy-paste code |
| Best Practices |
Magic numbers, missing docs, broad exceptions |
| Security |
Input validation, credential handling, injection risks |
| Performance |
O(n) issues, unnecessary copies, inefficient algorithms |
| Good Practices |
Highlight what the code does well |
Severity Levels
| Level |
Criteria |
| P0/Critical |
Race conditions, security vulnerabilities, data loss risks |
| P1/High |
Major bugs, architectural issues, memory leaks |
| P2/Medium |
Code quality issues, moderate violations |
| P3/Low |
Minor improvements, nice-to-have refactors |
Scoring
Rate each applicable category out of 10:
- Architecture, Thread Safety, Error Handling
- DRY Compliance, SOLID Compliance
- Security, Performance, Testability
Overall score: weighted average (bugs and security weighted higher).
Report Format
See references/report-template.md for the exact output structure.
Key formatting rules:
- Two-column tables for issue metadata (severity, location, impact, recommendation)
- Code blocks with language hints for all code examples
- Horizontal rules between major sections
- ASCII diagrams in code blocks for architecture
- Summary statistics table at the end
- Prioritized recommendations (P0/P1/P2/P3)
- Never use em-dashes
Output
Step 1: Create Individual Recommendation Issues
For each actionable recommendation, create a separate issue using the format in references/issue-template.md. Capture the returned issue URL for each.
bash scripts/create_issue.sh \
--project "[Project Name]" \
--title "[Brief issue title]" \
--label "code-audit,priority:[level],[category]" \
--body "$ISSUE_BODY"
Priority labels:
- P0/Critical →
priority:critical
- P1/High →
priority:high
- P2/Medium →
priority:medium
- P3/Low →
priority:low
Category labels (use as appropriate):
security, performance, bug, technical-debtarchitecture, observability, testing, documentation
Step 2: Create Full Audit Report with Subtasks
Append a "Related Issues" section to the full report with subtasks linking to each individual issue:
## Related Issues
- [ ] #123 - Fix race condition in data index map
- [ ] #124 - Add thread safety to RedisClient
- [ ] #125 - Extract side validation utility
- [ ] #126 - Add metrics and observability
Then create the main audit issue:
bash scripts/create_issue.sh \
--project "[Project Name]" \
--title "Code Audit Report - [Project] - [Date]" \
--label "code-audit" \
--body "$FULL_REPORT_WITH_SUBTASKS"
With a specific repository, add --repo "owner/repo".
Confirm all issue URLs with the user after creation.
1---2name: code-audit3description: Perform comprehensive code audits on repositories or directories. Use when asked to audit code, review a codebase, analyze code quality, find bugs, check for security issues, review architecture, check SOLID/DRY compliance, or generate a code audit report. Produces well-formatted markdown reports with prioritized recommendations.4---5
6# Code Audit
7
8Perform comprehensive code audits and generate structured markdown reports.
9
10## Workflow
11
121. **Scope**: Determine target (full repo, specific path, or focused concern)
132. **Discovery**: List and categorize source files
143. **Analysis**: Evaluate each category systematically
154. **Report**: Generate markdown report using template format
165. **GitHub Issues**: Create issues using `scripts/create_issue.sh`:
17 - First: Create individual issues for each actionable recommendation
18 - Then: Create the full audit report with subtasks linking to each issue
19
20## Analysis Categories
21
22| Category | What to Look For |
23|----------|------------------|
24| Architecture | Separation of concerns, component structure, dependencies |
25| Bugs | Race conditions, null checks, resource leaks, edge cases |
26| SOLID Violations | SRP (god classes), OCP, LSP, ISP, DIP issues |
27| DRY Violations | Duplicated logic, repeated patterns, copy-paste code |
28| Best Practices | Magic numbers, missing docs, broad exceptions |
29| Security | Input validation, credential handling, injection risks |
30| Performance | O(n) issues, unnecessary copies, inefficient algorithms |
31| Good Practices | Highlight what the code does well |
32
33## Severity Levels
34
35| Level | Criteria |
36|-------|----------|
37| P0/Critical | Race conditions, security vulnerabilities, data loss risks |
38| P1/High | Major bugs, architectural issues, memory leaks |
39| P2/Medium | Code quality issues, moderate violations |
40| P3/Low | Minor improvements, nice-to-have refactors |
41
42## Scoring
43
44Rate each applicable category out of 10:
45
46- Architecture, Thread Safety, Error Handling
47- DRY Compliance, SOLID Compliance
48- Security, Performance, Testability
49
50Overall score: weighted average (bugs and security weighted higher).
51
52## Report Format
53
54See [references/report-template.md](references/report-template.md) for the exact output structure.
55
56Key formatting rules:
57
58- Two-column tables for issue metadata (severity, location, impact, recommendation)
59- Code blocks with language hints for all code examples
60- Horizontal rules between major sections
61- ASCII diagrams in code blocks for architecture
62- Summary statistics table at the end
63- Prioritized recommendations (P0/P1/P2/P3)
64- Never use em-dashes
65
66## Output
67
68### Step 1: Create Individual Recommendation Issues
69
70For each actionable recommendation, create a separate issue using the format in [references/issue-template.md](references/issue-template.md). Capture the returned issue URL for each.
71
72```bash
73bash scripts/create_issue.sh \
74 --project "[Project Name]" \
75 --title "[Brief issue title]" \
76 --label "code-audit,priority:[level],[category]" \
77 --body "$ISSUE_BODY"
78```
79
80Priority labels:
81- P0/Critical → `priority:critical`
82- P1/High → `priority:high`
83- P2/Medium → `priority:medium`
84- P3/Low → `priority:low`
85
86Category labels (use as appropriate):
87- `security`, `performance`, `bug`, `technical-debt`
88- `architecture`, `observability`, `testing`, `documentation`
89
90### Step 2: Create Full Audit Report with Subtasks
91
92Append a "Related Issues" section to the full report with subtasks linking to each individual issue:
93
94```markdown
95## Related Issues
96
97- [ ] #123 - Fix race condition in data index map
98- [ ] #124 - Add thread safety to RedisClient
99- [ ] #125 - Extract side validation utility
100- [ ] #126 - Add metrics and observability
101```
102
103Then create the main audit issue:
104
105```bash
106bash scripts/create_issue.sh \
107 --project "[Project Name]" \
108 --title "Code Audit Report - [Project] - [Date]" \
109 --label "code-audit" \
110 --body "$FULL_REPORT_WITH_SUBTASKS"
111```
112
113With a specific repository, add `--repo "owner/repo"`.
114
115Confirm all issue URLs with the user after creation.
majiayu000