# Sre Audit

> Perform comprehensive SRE (Site Reliability Engineering) audits on any codebase. Use when users request code audits, security reviews, performance analysis, cost optimization, or maintainability assessments. Triggers on phrases like "audit this code", "review for security", "check performance", "analyze costs", "assess maintainability", "SRE review", or general code quality reviews.

- **Type:** Skill
- **Install:** `agentstack add skill-941consulting-claude-skills-sre-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [941consulting](https://agentstack.voostack.com/s/941consulting)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [941consulting](https://github.com/941consulting)
- **Source:** https://github.com/941consulting/claude-skills/tree/main/skills/sre-audit

## Install

```sh
agentstack add skill-941consulting-claude-skills-sre-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# SRE Audit Skill

Perform systematic SRE audits covering security, performance, cost, and maintainability.

## Audit Workflow

1. **Discover** - Scan codebase structure, identify key files and patterns
2. **Analyze** - Examine each audit area systematically
3. **Report** - Generate findings with severity and recommendations

## Audit Areas

### 1. Security

Examine for vulnerabilities and unsafe patterns:

- **Injection vulnerabilities**: SQL injection, command injection, path traversal
- **Input validation**: Parameter validation, type checking, boundary enforcement
- **Authentication/Authorization**: Credential handling, session management, access control
- **Data exposure**: Sensitive data in logs, error messages, comments
- **Dependency risks**: Known vulnerabilities, outdated packages, supply chain

See [references/security.md](references/security.md) for detailed patterns.
See [references/dependencies.md](references/dependencies.md) for ecosystem-specific package auditing.

### 2. Performance

Identify efficiency issues:

- **Database operations**: Missing indexes, N+1 queries, unbatched operations, inefficient joins
- **Memory usage**: Large data structures, unbounded collections, memory leaks
- **I/O patterns**: Blocking operations, missing caching, redundant reads
- **Algorithmic complexity**: O(n²) or worse in hot paths, unnecessary iterations
- **Concurrency**: Lock contention, thread safety, async/await patterns

See [references/performance.md](references/performance.md) for detailed patterns.

### 3. Cost

Assess operational expenses:

- **API/service calls**: Redundant calls, missing batching, rate limit risks
- **Database writes**: Unnecessary updates, transaction overhead, write amplification
- **Compute resources**: CPU-intensive operations, scaling inefficiencies
- **Storage**: Data retention, blob sizes, caching strategy
- **Third-party services**: Usage patterns, tier appropriateness

See [references/cost.md](references/cost.md) for detailed patterns.

### 4. Maintainability

Evaluate long-term code health:

- **Code quality**: Duplication, complexity, naming clarity
- **Error handling**: Consistency, coverage, error messages
- **Testing**: Coverage gaps, test quality, testability
- **Documentation**: API docs, inline comments, README completeness
- **Architecture**: Coupling, cohesion, separation of concerns

See [references/maintainability.md](references/maintainability.md) for detailed patterns.

## Analysis Process

For each file/module:

1. Identify the component's purpose and criticality
2. Check each audit area relevant to the component type
3. Note findings with file location, line numbers, and evidence
4. Assess severity: Critical, High, Medium, Low
5. Provide specific remediation recommendations

## Output Format

Generate a structured report:

```markdown
# SRE Audit Report: [Project/Component Name]

## Executive Summary
[Brief overview of audit scope and key findings]

## Critical Findings
[Issues requiring immediate attention]

## Security Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Performance Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Cost Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Maintainability Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Summary Statistics
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X

## Recommended Priority Actions
1. [Most urgent fix]
2. [Second priority]
3. [Third priority]
```

## Severity Definitions

- **Critical**: Exploitable vulnerability or production-impacting issue; fix immediately
- **High**: Significant risk or degradation; fix within days
- **Medium**: Notable concern; address in normal development
- **Low**: Minor improvement; consider for technical debt backlog

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [941consulting](https://github.com/941consulting)
- **Source:** [941consulting/claude-skills](https://github.com/941consulting/claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-941consulting-claude-skills-sre-audit
- Seller: https://agentstack.voostack.com/s/941consulting
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.