Code Hardcode Audit
When to Use This Skill
Use this skill when the user mentions:
- "hardcoded values", "hardcodes", "magic numbers"
- "constant detection", "find constants"
- "duplicate constants", "DRY violations"
- "code audit", "hardcode audit"
- "PLR2004", "semgrep", "jscpd", "gitleaks"
- "secret scanning", "leaked secrets", "API keys"
- "passwords in code", "credential leaks"
Quick Start
# Full audit (all tools, both outputs)
uv run --script scripts/audit_hardcodes.py -- src/
# Python magic numbers only (fastest)
uv run --script scripts/run_ruff_plr.py -- src/
# Pattern-based detection (URLs, ports, paths)
uv run --script scripts/run_semgrep.py -- src/
# Copy-paste detection
uv run --script scripts/run_jscpd.py -- src/
# Secret scanning (API keys, tokens, passwords)
uv run --script scripts/run_gitleaks.py -- src/
Tool Overview
| Tool |
Detection Focus |
Language Support |
Speed |
| Ruff PLR2004 |
Magic value comparisons |
Python |
Fast |
| Semgrep |
URLs, ports, paths, credentials |
Multi-language |
Medium |
| jscpd |
Duplicate code blocks |
Multi-language |
Slow |
| gitleaks |
Secrets, API keys, passwords |
Any (file-based) |
Fast |
Output Formats
JSON (--output json)
{
"summary": {
"total_findings": 42,
"by_tool": { "ruff": 15, "semgrep": 20, "jscpd": 7 },
"by_severity": { "high": 5, "medium": 25, "low": 12 }
},
"findings": [
{
"id": "MAGIC-001",
"tool": "ruff",
"rule": "PLR2004",
"file": "src/config.py",
"line": 42,
"column": 8,
"message": "Magic value used in comparison: 8123",
"severity": "medium",
"suggested_fix": "Extract to named constant"
}
],
"refactoring_plan": [
{
"priority": 1,
"action": "Create constants/ports.py",
"finding_ids": ["MAGIC-001", "MAGIC-003"]
}
]
}
Compiler-like Text (--output text)
src/config.py:42:8: PLR2004 Magic value used in comparison: 8123 [ruff]
src/probe.py:15:1: hardcoded-url Hardcoded URL detected [semgrep]
src/client.py:20-35: Clone detected (16 lines, 95% similarity) [jscpd]
Summary: 42 findings (ruff: 15, semgrep: 20, jscpd: 7)
CLI Options
--output {json,text,both} Output format (default: both)
--tools {all,ruff,semgrep,jscpd,gitleaks} Tools to run (default: all)
--severity {all,high,medium,low} Filter by severity (default: all)
--exclude PATTERN Glob pattern to exclude (repeatable)
--parallel Run tools in parallel (default: true)
References
Related
- ADR-0046: Semantic Constants Abstraction
- ADR-0047: Code Hardcode Audit Skill
code-clone-assistant - PMD CPD-based clone detection (DRY focus)
1---2name: code-hardcode-audit3description: Detects hardcoded values, magic numbers, duplicate constants, and leaked secrets using Ruff, Semgrep, jscpd, and gitleaks. Use when auditing for hardcodes, magic numbers, PLR2004, constant detection, secret scanning, or before release.4---5
6# Code Hardcode Audit
7
8## When to Use This Skill
9
10Use this skill when the user mentions:
11
12- "hardcoded values", "hardcodes", "magic numbers"
13- "constant detection", "find constants"
14- "duplicate constants", "DRY violations"
15- "code audit", "hardcode audit"
16- "PLR2004", "semgrep", "jscpd", "gitleaks"
17- "secret scanning", "leaked secrets", "API keys"
18- "passwords in code", "credential leaks"
19
20## Quick Start
21
22```bash
23# Full audit (all tools, both outputs)
24uv run --script scripts/audit_hardcodes.py -- src/
25
26# Python magic numbers only (fastest)
27uv run --script scripts/run_ruff_plr.py -- src/
28
29# Pattern-based detection (URLs, ports, paths)
30uv run --script scripts/run_semgrep.py -- src/
31
32# Copy-paste detection
33uv run --script scripts/run_jscpd.py -- src/
34
35# Secret scanning (API keys, tokens, passwords)
36uv run --script scripts/run_gitleaks.py -- src/
37```
38
39## Tool Overview
40
41| Tool | Detection Focus | Language Support | Speed |
42| ---------------- | ------------------------------- | ---------------- | ------ |
43| **Ruff PLR2004** | Magic value comparisons | Python | Fast |
44| **Semgrep** | URLs, ports, paths, credentials | Multi-language | Medium |
45| **jscpd** | Duplicate code blocks | Multi-language | Slow |
46| **gitleaks** | Secrets, API keys, passwords | Any (file-based) | Fast |
47
48## Output Formats
49
50### JSON (--output json)
51
52```json
53{
54 "summary": {
55 "total_findings": 42,
56 "by_tool": { "ruff": 15, "semgrep": 20, "jscpd": 7 },
57 "by_severity": { "high": 5, "medium": 25, "low": 12 }
58 },
59 "findings": [
60 {
61 "id": "MAGIC-001",
62 "tool": "ruff",
63 "rule": "PLR2004",
64 "file": "src/config.py",
65 "line": 42,
66 "column": 8,
67 "message": "Magic value used in comparison: 8123",
68 "severity": "medium",
69 "suggested_fix": "Extract to named constant"
70 }
71 ],
72 "refactoring_plan": [
73 {
74 "priority": 1,
75 "action": "Create constants/ports.py",
76 "finding_ids": ["MAGIC-001", "MAGIC-003"]
77 }
78 ]
79}
80```
81
82### Compiler-like Text (--output text)
83
84```
85src/config.py:42:8: PLR2004 Magic value used in comparison: 8123 [ruff]
86src/probe.py:15:1: hardcoded-url Hardcoded URL detected [semgrep]
87src/client.py:20-35: Clone detected (16 lines, 95% similarity) [jscpd]
88
89Summary: 42 findings (ruff: 15, semgrep: 20, jscpd: 7)
90```
91
92## CLI Options
93
94```
95--output {json,text,both} Output format (default: both)
96--tools {all,ruff,semgrep,jscpd,gitleaks} Tools to run (default: all)
97--severity {all,high,medium,low} Filter by severity (default: all)
98--exclude PATTERN Glob pattern to exclude (repeatable)
99--parallel Run tools in parallel (default: true)
100```
101
102## References
103
104- [Tool Comparison](./references/tool-comparison.md) - Detailed tool capabilities
105- [Output Schema](./references/output-schema.md) - JSON schema specification
106- [Troubleshooting](./references/troubleshooting.md) - Common issues and fixes
107
108## Related
109
110- ADR-0046: Semantic Constants Abstraction
111- ADR-0047: Code Hardcode Audit Skill
112- `code-clone-assistant` - PMD CPD-based clone detection (DRY focus)
majiayu000