Sre Audit

SRE Audit Skill

Perform systematic SRE audits covering security, performance, cost, and maintainability.

Audit Workflow

1. Discover - Scan codebase structure, identify key files and patterns
2. Analyze - Examine each audit area systematically
3. Report - Generate findings with severity and recommendations

Audit Areas

1. Security

Examine for vulnerabilities and unsafe patterns:

• Injection vulnerabilities: SQL injection, command injection, path traversal
• Input validation: Parameter validation, type checking, boundary enforcement
• Authentication/Authorization: Credential handling, session management, access control
• Data exposure: Sensitive data in logs, error messages, comments
• Dependency risks: Known vulnerabilities, outdated packages, supply chain

See [references/security.md](references/security.md) for detailed patterns. See [references/dependencies.md](references/dependencies.md) for ecosystem-specific package auditing.

2. Performance

Identify efficiency issues:

• Database operations: Missing indexes, N+1 queries, unbatched operations, inefficient joins
• Memory usage: Large data structures, unbounded collections, memory leaks
• I/O patterns: Blocking operations, missing caching, redundant reads
• Algorithmic complexity: O(n²) or worse in hot paths, unnecessary iterations
• Concurrency: Lock contention, thread safety, async/await patterns

See [references/performance.md](references/performance.md) for detailed patterns.

3. Cost

Assess operational expenses:

• API/service calls: Redundant calls, missing batching, rate limit risks
• Database writes: Unnecessary updates, transaction overhead, write amplification
• Compute resources: CPU-intensive operations, scaling inefficiencies
• Storage: Data retention, blob sizes, caching strategy
• Third-party services: Usage patterns, tier appropriateness

See [references/cost.md](references/cost.md) for detailed patterns.

4. Maintainability

Evaluate long-term code health:

• Code quality: Duplication, complexity, naming clarity
• Error handling: Consistency, coverage, error messages
• Testing: Coverage gaps, test quality, testability
• Documentation: API docs, inline comments, README completeness
• Architecture: Coupling, cohesion, separation of concerns

See [references/maintainability.md](references/maintainability.md) for detailed patterns.

Analysis Process

For each file/module:

1. Identify the component's purpose and criticality
2. Check each audit area relevant to the component type
3. Note findings with file location, line numbers, and evidence
4. Assess severity: Critical, High, Medium, Low
5. Provide specific remediation recommendations

Output Format

Generate a structured report:

# SRE Audit Report: [Project/Component Name]

## Executive Summary
[Brief overview of audit scope and key findings]

## Critical Findings
[Issues requiring immediate attention]

## Security Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Performance Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Cost Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Maintainability Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Summary Statistics
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X

## Recommended Priority Actions
1. [Most urgent fix]
2. [Second priority]
3. [Third priority]

Severity Definitions

• Critical: Exploitable vulnerability or production-impacting issue; fix immediately
• High: Significant risk or degradation; fix within days
• Medium: Notable concern; address in normal development
• Low: Minor improvement; consider for technical debt backlog

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: 941consulting
• Source: 941consulting/claude-skills
• License: MIT

Install and usage instructions live in the source repository linked above.