# Audit

> Use when reviewing code for security vulnerabilities (SQL injection, XSS, hardcoded secrets, CSRF), performance issues (N+1 queries, memory leaks, blocking async), or code quality concerns (complexity, error handling, type safety).

- Skill: `tomevault-io/audit-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/audit-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/audit-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/audit-2

---


# Security Audit

Analyze code for vulnerabilities, performance issues, and bad practices.

## Checklist

| Category | Issues to Find |
|----------|----------------|
| Injection | SQL concatenation, XSS, command injection, path traversal |
| Secrets | Hardcoded credentials, API keys in code, .env committed |
| Auth | Missing validation, broken access control, CSRF |
| Performance | N+1 queries, unbounded loops, blocking in async |
| Resilience | Unhandled errors, missing timeouts, race conditions |
| Quality | Magic numbers, deep nesting, missing types, dead code |

## Output Format

```markdown
## Issues

### HIGH
- [file:line] Issue description
- [file:line] Issue description

### MEDIUM
- [file:line] Issue description

### LOW
- [file:line] Issue description

## Fixes

### [Issue name]
[Fixed code - no explanation]
```

Provide fixes for top 3 HIGH/MEDIUM issues. Code only, no explanations.

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/mlorentedev) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-14 -->