Codebase Auditor
Comprehensive codebase audits using modern software engineering standards with actionable remediation plans.
When to Use
- Audit codebase for quality, security, maintainability
- Assess technical debt and estimate remediation
- Prepare production readiness report
- Evaluate legacy codebase for modernization
- Set up quality gates for CI/CD pipelines
- Configure incremental audits for large codebases (>100k LOC)
- Track audit history and trends over time
Trigger Phrases
- "Audit this codebase" / "Run a code audit"
- "Security scan" / "Check for vulnerabilities"
- "Assess technical debt" / "How much tech debt?"
- "Production readiness review"
- "Set up quality gates"
- "DORA metrics" / "Deployment health"
Audit Phases
Phase 1: Initial Assessment
- Project discovery (tech stack, frameworks, tools)
- Quick health check (LOC, docs, git practices)
- Red flag detection (secrets, massive files)
Phase 2: Deep Analysis
Load on demand based on Phase 1 findings.
Phase 3: Report Generation
Comprehensive report with scores and priorities.
Phase 4: Remediation Planning
Prioritized action plan with effort estimates.
Analysis Categories
| Category |
Key Checks |
| Code Quality |
Complexity, duplication, code smells |
| Testing |
Coverage (80% min), trophy distribution, quality |
| Security |
OWASP Top 10, dependencies, secrets |
| Architecture |
SOLID, patterns, modularity |
| Performance |
Build time, bundle size, runtime |
| Documentation |
JSDoc, README, ADRs |
| DevOps |
CI/CD maturity, DORA metrics |
| Accessibility |
WCAG 2.1 AA compliance |
Technical Debt Rating (SQALE)
| Grade |
Remediation Effort |
| A |
<= 5% of dev time |
| B |
6-10% |
| C |
11-20% |
| D |
21-50% |
| E |
> 50% |
Usage Examples
# Basic audit
Audit this codebase using the codebase-auditor skill.
# Security focused
Run a security-focused audit on this codebase.
# Quick health check
Give me a quick health check (Phase 1 only).
# Custom scope
Audit focusing on test coverage and security.
Output Formats
- Markdown Report - Human-readable for PR comments
- JSON Report - Machine-readable for CI/CD
- HTML Dashboard - Interactive visualization
- Remediation Plan - Prioritized action items
Priority Levels
| Priority |
Examples |
Timeline |
| P1 Critical |
Security vulns, data loss risks |
Immediate |
| P2 High |
Coverage gaps, performance issues |
This sprint |
| P3 Medium |
Code smells, doc gaps |
Next quarter |
| P4 Low |
Stylistic, minor optimizations |
Backlog |
Best Practices
- Run incrementally for large codebases
- Focus on critical paths first
- Baseline before major releases
- Track metrics over time
- Integrate with CI/CD
Integrations
Complements: SonarQube, ESLint, Jest/Vitest, npm audit, Lighthouse, GitHub Actions
Limitations
- Static analysis only (no runtime profiling)
- Requires source code access
- Internet needed for CVE data
- Large codebases need chunked analysis
Additional Resources
| Resource |
Path |
Description |
| Audit Criteria |
reference/audit_criteria.md |
Complete checklist (200+ items) |
| Severity Matrix |
reference/severity_matrix.md |
Scoring rubric |
| Best Practices |
reference/best_practices_2025.md |
SDLC standards |
| CI Integration |
reference/ci-integration.md |
GitHub Actions workflows |
| Incremental Audit |
workflow/incremental-audit.md |
Large codebase strategies |
| History Schema |
templates/audit-history-schema.sql |
SQLite tracking |
| Custom Rules |
data/custom-rules.yaml |
Rule template |
1---2name: codebase-auditor3description: Use PROACTIVELY when auditing code quality, running security scans, assessing technical debt, reviewing code for production readiness, setting up CI quality gates, or tracking DORA metrics. Analyzes codebases against OWASP Top 10, SOLID principles, Testing Trophy, and 2024-25 SDLC standards. Supports incremental audits for large codebases. Not for runtime profiling or real-time monitoring.4---5
6# Codebase Auditor
7
8Comprehensive codebase audits using modern software engineering standards with actionable remediation plans.
9
10## When to Use
11
12- Audit codebase for quality, security, maintainability
13- Assess technical debt and estimate remediation
14- Prepare production readiness report
15- Evaluate legacy codebase for modernization
16- Set up quality gates for CI/CD pipelines
17- Configure incremental audits for large codebases (>100k LOC)
18- Track audit history and trends over time
19
20## Trigger Phrases
21
22- "Audit this codebase" / "Run a code audit"
23- "Security scan" / "Check for vulnerabilities"
24- "Assess technical debt" / "How much tech debt?"
25- "Production readiness review"
26- "Set up quality gates"
27- "DORA metrics" / "Deployment health"
28
29## Audit Phases
30
31### Phase 1: Initial Assessment
32- Project discovery (tech stack, frameworks, tools)
33- Quick health check (LOC, docs, git practices)
34- Red flag detection (secrets, massive files)
35
36### Phase 2: Deep Analysis
37Load on demand based on Phase 1 findings.
38
39### Phase 3: Report Generation
40Comprehensive report with scores and priorities.
41
42### Phase 4: Remediation Planning
43Prioritized action plan with effort estimates.
44
45## Analysis Categories
46
47| Category | Key Checks |
48|----------|------------|
49| Code Quality | Complexity, duplication, code smells |
50| Testing | Coverage (80% min), trophy distribution, quality |
51| Security | OWASP Top 10, dependencies, secrets |
52| Architecture | SOLID, patterns, modularity |
53| Performance | Build time, bundle size, runtime |
54| Documentation | JSDoc, README, ADRs |
55| DevOps | CI/CD maturity, DORA metrics |
56| Accessibility | WCAG 2.1 AA compliance |
57
58## Technical Debt Rating (SQALE)
59
60| Grade | Remediation Effort |
61|-------|-------------------|
62| A | <= 5% of dev time |
63| B | 6-10% |
64| C | 11-20% |
65| D | 21-50% |
66| E | > 50% |
67
68## Usage Examples
69
70```
71# Basic audit
72Audit this codebase using the codebase-auditor skill.
73
74# Security focused
75Run a security-focused audit on this codebase.
76
77# Quick health check
78Give me a quick health check (Phase 1 only).
79
80# Custom scope
81Audit focusing on test coverage and security.
82```
83
84## Output Formats
85
861. **Markdown Report** - Human-readable for PR comments
872. **JSON Report** - Machine-readable for CI/CD
883. **HTML Dashboard** - Interactive visualization
894. **Remediation Plan** - Prioritized action items
90
91## Priority Levels
92
93| Priority | Examples | Timeline |
94|----------|----------|----------|
95| P1 Critical | Security vulns, data loss risks | Immediate |
96| P2 High | Coverage gaps, performance issues | This sprint |
97| P3 Medium | Code smells, doc gaps | Next quarter |
98| P4 Low | Stylistic, minor optimizations | Backlog |
99
100## Best Practices
101
1021. Run incrementally for large codebases
1032. Focus on critical paths first
1043. Baseline before major releases
1054. Track metrics over time
1065. Integrate with CI/CD
107
108## Integrations
109
110Complements: SonarQube, ESLint, Jest/Vitest, npm audit, Lighthouse, GitHub Actions
111
112## Limitations
113
114- Static analysis only (no runtime profiling)
115- Requires source code access
116- Internet needed for CVE data
117- Large codebases need chunked analysis
118
119## Additional Resources
120
121| Resource | Path | Description |
122|----------|------|-------------|
123| Audit Criteria | `reference/audit_criteria.md` | Complete checklist (200+ items) |
124| Severity Matrix | `reference/severity_matrix.md` | Scoring rubric |
125| Best Practices | `reference/best_practices_2025.md` | SDLC standards |
126| CI Integration | `reference/ci-integration.md` | GitHub Actions workflows |
127| Incremental Audit | `workflow/incremental-audit.md` | Large codebase strategies |
128| History Schema | `templates/audit-history-schema.sql` | SQLite tracking |
129| Custom Rules | `data/custom-rules.yaml` | Rule template |
majiayu000