Astro Audit

Astro Audit Skill

Production readiness audit.

Core Rules (BLOCK)

Core Rules (WARN)

Audit Sequence

npx astro check           # TypeScript
npm audit --audit-level=high  # Security
npx depcheck              # Unused deps
npx astro build           # Build
# Then: Lighthouse, Browser tests, Form tests

Run scripts/audit.sh for automated checks.

Browser Compatibility (Required)

See references/browser-tests.md.

Form Testing (10 Scenarios)

See references/form-tests.md.

Credential Scan (BLOCK)

grep -rn "sk_live\|pk_live\|api_key\|secret" src/
git ls-files | grep "\.env$"

ANY match = BLOCK RELEASE

See references/credential-scan.md.

Skill Compliance

Verify against all active skills:

• astro-forms (Turnstile, honeypot, Zod)
• astro-security (headers, CSP, rate limit)
• astro-ux (sections, CTAs, mobile bar)
• Project SPEC.md

See references/skill-compliance.md.

Definition of Done

BLOCK (must fix):

• astro check passes
• astro build succeeds
• npm audit clean
• No credentials in code
• .env not in git
• Lighthouse 90+ all categories
• All 10 form tests pass
• Browser compatibility verified

Quality:

• Bundle < 100kb JS
• No console.logs
• Skill compliance verified
• Mobile tested real device

Automated Script

#!/bin/bash
# scripts/audit.sh
set -e

echo "🔍 Audit..."
npx astro check
npm audit --audit-level=high

# Credential scan
if grep -rn "sk_live\|pk_live" src/ 2>/dev/null; then
  echo "❌ BLOCK: Credentials found"; exit 1
fi
if git ls-files | grep -qE "^\.env$"; then
  echo "❌ BLOCK: .env in git"; exit 1
fi

npx astro build

JS=$(find dist -name "*.js" -exec cat {} + 2>/dev/null | wc -c)
[ $JS -gt 102400 ] && echo "⚠️ JS > 100kb"

echo "✅ Auto-audit done. Run browser + form tests manually."

References

• browser-tests.md — Cross-browser matrix
• form-tests.md — 10-scenario form testing
• credential-scan.md — Secret patterns
• skill-compliance.md — Skill verification
• seo-checks.md — SEO audit
• performance.md — Core Web Vitals
• a11y-checks.md — Accessibility