# Cli Audit Code

> Audit code quality with weighted scoring across 12 dimensions (naming, complexity, module design, DRY, errors, security, tests, architecture). Detects named anti-patterns (Fowler/Mantyla taxonomy). Use when reviewing code quality, auditing clean code compliance, checking for code smells, or saying 'audit code', 'code quality', 'code review', 'tech debt'. Invoke with an optional file or directory…

- **Type:** Skill
- **Install:** `agentstack add skill-destynova2-cli-code-skills-cli-audit-code`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Destynova2](https://agentstack.voostack.com/s/destynova2)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Destynova2](https://github.com/Destynova2)
- **Source:** https://github.com/Destynova2/cli-code-skills/tree/main/cli-audit-code

## Install

```sh
agentstack add skill-destynova2-cli-code-skills-cli-audit-code
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

> **Optimization:** This skill uses on-demand loading. Heavy content lives in `references/` and is loaded only when needed.

> **Language rule:** Skill instructions are written in English. When generating user-facing output, detect the project's primary language (from README, comments, docs, commit messages) and produce the report in that language. If the project is bilingual, ask the user which language to use before proceeding.

# Audit Code — Code Quality Index (CQI)

> "Complexity is the single greatest enemy of reliability." — John Ousterhout

## Core Principles

1. **Evidence-based** — every finding needs a `file:line` reference. No vague "the code could be better"
2. **Proportional** — a 200-line function matters more than a missing doc comment. Scale to project type
3. **Language-aware** — detect the project language and apply its idiomatic patterns, not Java/C# defaults
4. **Named anti-patterns** — use Fowler/Mantyla taxonomy names (Feature Envy, Shotgun Surgery) in findings
5. **Positive reinforcement** — always highlight good practices found, not just violations
6. **Gotchas** — read `../gotchas.md` before producing output to avoid known mistakes

## Input

`$ARGUMENTS` is the target to audit (file path, directory, or empty for whole `src/`).

- If a specific file: audit that file deeply
- If a directory: audit all source files in it
- If empty: audit `src/` broadly (sample 15-20 key files)

## 12-Dimension Framework

Score each dimension **0.0-1.0**, then compute a weighted CQI. Read `references/categories.md` for detailed check lists per category.

| # | Category | Weight | Key question |
|---|----------|--------|-------------|
| C1 | Naming & Readability | 8% | Do names reveal intent? No magic numbers? |
| C2 | Functions & Cognitive Complexity | 12% |  500 lines, many responsibilities) | `/cli-audit-tangle` | Topology analysis reveals optimal split points |
| Hardcoded secrets or `.env` tracked in git (C9) | `/cli-git-conventional --audit-markers` | Check git history for leaked secrets |
| Shell scripts in the project with quality issues | `/cli-audit-shell` | Deep bash-specific audit beyond C6 idioms |
| Missing or stale documentation (C7 low) | `/cli-forge-doc` | Generate/update project docs |
| Test quality issues (C8 low) | `/cli-audit-test` | Full test strategy audit |
| CI/CD config present but not audited | `/cli-forge-pipeline` | Pipeline optimization |
| Static perf anti-pattern detected (alloc in loop, O(n²), N+1) on a hot service | `/cli-forge-perf` | Confirm the dynamic cost and lock the fix with an A/B bench gate |

**Rule:** Recommend, don't auto-execute. Phrase as: "Consider running `/cli-audit-tangle` — 3 god modules detected that need topology analysis."

## Reference Sources

- Ousterhout — *A Philosophy of Software Design* | Martin — *Clean Code* | Fowler — *Refactoring* | Tornhill — *Software Design X-Rays* | Feathers — *Working Effectively with Legacy Code*
- SonarQube Quality Model | SonarSource Cognitive Complexity | SQALE Method | CodeScene Code Health | Clippy lint categories
- CodeAesthetic | ThePrimeagen | ArjanCodes | Software Engineering Radio | Tech Lead Journal

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Destynova2](https://github.com/Destynova2)
- **Source:** [Destynova2/cli-code-skills](https://github.com/Destynova2/cli-code-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-destynova2-cli-code-skills-cli-audit-code
- Seller: https://agentstack.voostack.com/s/destynova2
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.