Codebase Audit
Core Insight: Different domains need different lenses. A security audit looks for injection; a UX audit looks for confusion. Same codebase, different questions.
When to Use What
| Need |
Skill |
| Find and report domain-specific issues |
codebase-audit (this) |
| Find bugs and fix them iteratively |
multi-pass-bug-hunting |
| Evaluate usability specifically |
ux-audit |
| Make UI visually polished |
ui-polish |
THE EXACT PROMPT
Perform a comprehensive [DOMAIN] audit of this codebase.
Domain: security | ux | performance | api | copy | cli
Return a detailed report with:
- File path and line numbers for each issue
- Severity (Critical/High/Medium/Low)
- Root cause analysis
- Recommended fix
Use the output template and domain checklist from references.
Quick Multi-Domain Sweep
Run quick audits across: security, performance, api
For each domain: top 3 issues only, with severity and fix.
Total output under 100 lines.
Domains at a Glance
| Domain |
Key Question |
Top Signals |
| security |
Can attackers exploit this? |
injection, auth bypass, secrets in code |
| ux |
Is this confusing? |
accessibility, error handling, flows |
| performance |
Is this slow? |
N+1 queries, blocking I/O, missing cache |
| api |
Is this pleasant to consume? |
status codes, error format, pagination |
| copy |
Is this clear? |
jargon, tone, error messages |
| cli |
Is this discoverable? |
--help, exit codes, progress feedback |
Full checklists: CHECKLISTS.md
Output Template
# [Domain] Audit Report: [Project]
## Summary
- **Total:** N findings
- **Critical:** X | **High:** Y | **Medium:** Z | **Low:** W
## Critical Findings
### [Title]
- **Location:** `file.rs:42`
- **Issue:** [What's wrong]
- **Root Cause:** [Why]
- **Fix:** [Solution]
## High / Medium / Low
[Same format, decreasing detail]
Severity
| Level |
Criteria |
Example |
| Critical |
Exploitable now, data loss |
SQL injection, unauth admin |
| High |
Serious, harder to exploit |
CSRF missing, N+1 on hot path |
| Medium |
Real issue, limited scope |
Missing validation, vague errors |
| Low |
Polish, best practice |
Naming inconsistency, missing docs |
Workflow Integration
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐
│ codebase-audit │────▶│ Create beads for │────▶│ multi-pass-bug │
│ (find + report) │ │ critical issues │ │ hunting (fix) │
└─────────────────┘ └──────────────────┘ └─────────────────┘
# After audit, create issues
br create --title="[Security] SQL injection in user_search" \
--type=bug --priority=0 --body="Found at src/search.rs:42"
Quick Grep Patterns
Security
rg -n "unwrap\(\)|panic!" --type rust # Rust panics
rg -n "eval\(|exec\(" --type js --type py # Code injection
rg -n "password|secret|api_key" --type-not lock # Hardcoded secrets
Performance
rg -n "for.*await|\.await.*for" --type rust # Async in loops
rg -n "SELECT.*FROM.*WHERE" | grep -v "LIMIT" # Unbounded queries
CLI
./tool --help | head -20 # Help exists?
./tool --unknown 2>&1; echo "Exit: $?" # Error handling
More patterns: TOOLS.md
Anti-Patterns
| Don't |
Do |
| "code is bad" |
Specific file:line + fix |
| Mix severities |
Group by impact |
| Audit everything at once |
One domain, deep |
| Skip root cause |
Explain WHY, not just WHAT |
| Report-only |
Create issues for criticals |
References
| Topic |
File |
| Full domain checklists |
CHECKLISTS.md |
| Example audit reports |
EXAMPLES.md |
| Tool commands by domain |
TOOLS.md |
1---2name: codebase-audit-23description: Domain-parameterized codebase auditing (security, UX, performance, API, copy, CLI). Use when auditing code, assessing quality, finding issues, or pre-launch review.4---5
6<!-- TOC: Core | Prompt | Domains | Output | Severity | Integration | Anti-Patterns | References -->
7
8# Codebase Audit
9
10> **Core Insight:** Different domains need different lenses. A security audit looks for injection; a UX audit looks for confusion. Same codebase, different questions.
11
12## When to Use What
13
14| Need | Skill |
15|------|-------|
16| Find and **report** domain-specific issues | **codebase-audit** (this) |
17| Find bugs and **fix them iteratively** | multi-pass-bug-hunting |
18| Evaluate **usability** specifically | ux-audit |
19| Make UI **visually polished** | ui-polish |
20
21---
22
23## THE EXACT PROMPT
24
25```
26Perform a comprehensive [DOMAIN] audit of this codebase.
27
28Domain: security | ux | performance | api | copy | cli
29
30Return a detailed report with:
31- File path and line numbers for each issue
32- Severity (Critical/High/Medium/Low)
33- Root cause analysis
34- Recommended fix
35
36Use the output template and domain checklist from references.
37```
38
39### Quick Multi-Domain Sweep
40
41```
42Run quick audits across: security, performance, api
43
44For each domain: top 3 issues only, with severity and fix.
45Total output under 100 lines.
46```
47
48---
49
50## Domains at a Glance
51
52| Domain | Key Question | Top Signals |
53|--------|--------------|-------------|
54| **security** | Can attackers exploit this? | injection, auth bypass, secrets in code |
55| **ux** | Is this confusing? | accessibility, error handling, flows |
56| **performance** | Is this slow? | N+1 queries, blocking I/O, missing cache |
57| **api** | Is this pleasant to consume? | status codes, error format, pagination |
58| **copy** | Is this clear? | jargon, tone, error messages |
59| **cli** | Is this discoverable? | --help, exit codes, progress feedback |
60
61Full checklists: [CHECKLISTS.md](references/CHECKLISTS.md)
62
63---
64
65## Output Template
66
67```markdown
68# [Domain] Audit Report: [Project]
69
70## Summary
71- **Total:** N findings
72- **Critical:** X | **High:** Y | **Medium:** Z | **Low:** W
73
74## Critical Findings
75
76### [Title]
77- **Location:** `file.rs:42`
78- **Issue:** [What's wrong]
79- **Root Cause:** [Why]
80- **Fix:** [Solution]
81
82## High / Medium / Low
83[Same format, decreasing detail]
84```
85
86---
87
88## Severity
89
90| Level | Criteria | Example |
91|-------|----------|---------|
92| **Critical** | Exploitable now, data loss | SQL injection, unauth admin |
93| **High** | Serious, harder to exploit | CSRF missing, N+1 on hot path |
94| **Medium** | Real issue, limited scope | Missing validation, vague errors |
95| **Low** | Polish, best practice | Naming inconsistency, missing docs |
96
97---
98
99## Workflow Integration
100
101```
102┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐
103│ codebase-audit │────▶│ Create beads for │────▶│ multi-pass-bug │
104│ (find + report) │ │ critical issues │ │ hunting (fix) │
105└─────────────────┘ └──────────────────┘ └─────────────────┘
106```
107
108```bash
109# After audit, create issues
110br create --title="[Security] SQL injection in user_search" \
111 --type=bug --priority=0 --body="Found at src/search.rs:42"
112```
113
114---
115
116## Quick Grep Patterns
117
118### Security
119```bash
120rg -n "unwrap\(\)|panic!" --type rust # Rust panics
121rg -n "eval\(|exec\(" --type js --type py # Code injection
122rg -n "password|secret|api_key" --type-not lock # Hardcoded secrets
123```
124
125### Performance
126```bash
127rg -n "for.*await|\.await.*for" --type rust # Async in loops
128rg -n "SELECT.*FROM.*WHERE" | grep -v "LIMIT" # Unbounded queries
129```
130
131### CLI
132```bash
133./tool --help | head -20 # Help exists?
134./tool --unknown 2>&1; echo "Exit: $?" # Error handling
135```
136
137More patterns: [TOOLS.md](references/TOOLS.md)
138
139---
140
141## Anti-Patterns
142
143| Don't | Do |
144|-------|-----|
145| "code is bad" | Specific `file:line` + fix |
146| Mix severities | Group by impact |
147| Audit everything at once | One domain, deep |
148| Skip root cause | Explain WHY, not just WHAT |
149| Report-only | Create issues for criticals |
150
151---
152
153## References
154
155| Topic | File |
156|-------|------|
157| Full domain checklists | [CHECKLISTS.md](references/CHECKLISTS.md) |
158| Example audit reports | [EXAMPLES.md](references/EXAMPLES.md) |
159| Tool commands by domain | [TOOLS.md](references/TOOLS.md) |
majiayu000