# Codebase Deep Audit

> Use this skill when the user asks for a deep audit, code review, health check, or technical debt assessment of an entire codebase or repository. Triggers include phrases like "audit my codebase", "review this repo", "find tech debt", "is this codebase production-ready", "what's wrong with this project", "code quality report", or "deep review". This skill produces a deterministic, project-type-awa…

- **Type:** Skill
- **Install:** `agentstack add skill-idle-sync-skills-codebase-deep-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Idle-Sync](https://agentstack.voostack.com/s/idle-sync)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Idle-Sync](https://github.com/Idle-Sync)
- **Source:** https://github.com/Idle-Sync/skills/tree/main/codebase-deep-audit

## Install

```sh
agentstack add skill-idle-sync-skills-codebase-deep-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Codebase Deep Audit

A deterministic, no-nitpick audit that grounds every finding in real evidence from the codebase. Produces a 0-100 score and a prioritized fix list — nothing else, no fluff.

## Core principles (non-negotiable)

1. **No nitpicks.** Style preferences, naming opinions, "I would have written it this way" — all banned. Only findings that map to a measurable risk (security, reliability, maintainability cost, performance, correctness) are recorded.
2. **Grounded in evidence.** Every finding MUST include `path/to/file.ext:line_number` and a one-line excerpt of the actual code. No file:line, no finding. If the issue spans multiple files, list all of them.
3. **Think before speaking.** Reconnaissance phase is mandatory and happens before ANY finding is written. Findings written during recon are discarded.
4. **Deterministic scoring.** Use the rubric in `references/scoring-rubric.md`. Two runs on the same codebase at the same commit must produce the same score (±2 points for non-deterministic tool output).
5. **Project-type aware.** Detect the project type first; apply the matching category set. Don't audit a CLI tool for accessibility.
6. **Actionable only.** Every finding must answer: *what to do, where, and why it matters.* If you can't write the fix in one sentence, the finding is too vague — drop it.

## Phase 0: Reconnaissance (think before speaking)

Do ALL of this before recording any findings. Output nothing to the user during this phase except a brief "Starting audit..." acknowledgment.

### 0.1 Detect project type

Run these checks in order. A project can have multiple types (e.g., fullstack = frontend + backend).

| Signal | Project type tag |
|---|---|
| `package.json` with `react`, `vue`, `svelte`, `next`, `nuxt`, `astro`, `solid` deps | `frontend` |
| `index.html` at root + `` tags or bundler config | `frontend` |
| `package.json` with `express`, `fastify`, `koa`, `hapi`, `nest` | `backend-node` |
| `requirements.txt`/`pyproject.toml` with `fastapi`, `flask`, `django`, `starlette` | `backend-python` |
| `go.mod` with `net/http`, `gin`, `echo`, `fiber` | `backend-go` |
| `Cargo.toml` with `actix`, `axum`, `rocket`, `warp` | `backend-rust` |
| `bin/` entry in `package.json` OR `[project.scripts]` in `pyproject.toml` OR single-file script | `cli` |
| `Dockerfile` + `docker-compose.yml` + multiple services | `infra-heavy` |
| ML notebook files (`.ipynb`) or training scripts | `ml-pipeline` |
| `prisma/schema.prisma`, `migrations/`, `alembic/` | `database-driven` (modifier) |
| Mobile: `ios/`, `android/`, `app.json` (Expo), `pubspec.yaml` (Flutter) | `mobile` |

Record detected types. The category set for scoring depends on this.

### 0.2 Detect primary languages

Use file extension counts. Record top 3 languages by LOC. This determines which language-specific rules apply (e.g., Python → check for mutable default args; JS/TS → check for `==` vs `===` in security-sensitive code; Go → check for unhandled `err`).

### 0.3 Map the codebase shape

Record:
- Total LOC (excluding `node_modules`, `.venv`, `dist`, `build`, vendored deps)
- Number of source files
- Top-level directory structure (depth 2 max)
- Entry points (main files, `bin/`, route files)
- Test directory presence and rough test count
- Lockfile presence (`package-lock.json`, `poetry.lock`, `go.sum`, etc.)
- CI config presence (`.github/workflows/`, `.gitlab-ci.yml`, etc.)

### 0.4 Identify the threat surface

Before security review, identify what this codebase actually exposes:
- HTTP endpoints (search for route definitions)
- Database connections (search for connection strings, ORM init)
- File I/O paths (especially user-controlled paths)
- Subprocess/shell execution (`exec`, `spawn`, `os.system`, `subprocess`)
- Deserialization (`pickle`, `eval`, `JSON.parse` on untrusted input)
- External API calls (auth handling, secret usage)

If the codebase has zero attack surface (e.g., a pure data analysis script), security category weight gets redistributed. See scoring rubric.

### 0.5 Decide the category set

Based on detected project types, select categories from `references/category-matrix.md`. Equal weights across the SELECTED categories. Final score = sum of category scores ÷ number of categories.

## Phase 1: Evidence gathering

For each selected category, run the checks defined in `references/category-checks.md`. Use grep/ripgrep, AST tools where appropriate, and direct file reads for any flagged file.

**Rules during evidence gathering:**
- Read the file before recording a finding. Grep matches alone are not evidence.
- If a "violation" has a clear comment explaining why (e.g., `# noqa: intentional bypass for legacy migration`), check the explanation. If reasonable, skip.
- Track each finding as a tuple: `(category, severity, file, line, excerpt, fix_in_one_sentence)`.

**Severity assignment (deterministic):**
- **P0 (critical):** Active security vulnerability, data loss risk, or production outage cause. Examples: hardcoded secrets in committed code, SQL injection, missing authn on a privileged route, infinite retry on user input.
- **P1 (high):** Reliability or correctness issue likely to bite within months. Examples: unhandled error paths in critical flows, race conditions in shared state, N+1 in a hot path, missing idempotency on a mutation.
- **P2 (medium):** Maintainability or tech debt issue costing dev time. Examples: dead code blocks >50 LOC, duplicated logic in 3+ places, deprecated API with announced EOL, dependency >2 major versions behind on a critical lib.

Anything below P2 is a nitpick. Drop it.

## Phase 2: Scoring

Apply `references/scoring-rubric.md` exactly. Each category starts at 100 and points are deducted per finding. The rubric specifies max deduction per finding type, so the score has a floor.

Final score = mean of category scores, rounded to nearest integer.

## Phase 3: Report generation

Use `templates/audit-report-template.md`. Required sections, in this order:
1. **Project profile** (detected types, languages, LOC, threat surface summary)
2. **Score** (overall + per-category breakdown)
3. **P0 findings** (must-fix-now, with file:line and one-sentence fix)
4. **P1 findings** (high-priority, same format)
5. **P2 findings** (tech debt, same format)
6. **Prioritized fix list** (top 10 actions in order, estimated effort: S/M/L)
7. **What was NOT audited** (be explicit about scope limits)

**Banned content in the report:**
- "Consider..." / "You might want to..." / "It would be nice if..." — replace with imperative actions or drop
- Style opinions
- Praise paragraphs ("overall a well-structured codebase!")
- Generic advice not tied to a specific file:line
- Findings without file:line citations

## Phase 4: Self-check before delivery

Before showing the report to the user, verify:
- [ ] Every finding has a file:line citation
- [ ] Every finding has a one-sentence actionable fix
- [ ] No finding is purely stylistic
- [ ] Score math is correct (recompute it)
- [ ] "What was NOT audited" section is honest about gaps
- [ ] Report contains zero hedging words from the banned list above

If any check fails, fix it before delivery.

## Reference files

Always read these before starting an audit. They contain the deterministic rules:
- `references/category-matrix.md` — which categories apply to which project types
- `references/category-checks.md` — exact checks per category
- `references/scoring-rubric.md` — point deductions per finding type
- `templates/audit-report-template.md` — required output structure

## Anti-patterns to avoid

- **Don't audit dependencies' source code.** Stay in the user's code.
- **Don't run the code.** This is static analysis only unless the user explicitly asks for runtime profiling.
- **Don't suggest rewrites.** "Rewrite this in Rust" is not actionable feedback.
- **Don't pad the report.** If a category has zero findings, write "No findings." and move on.
- **Don't audit generated files** (`*.generated.ts`, migration files unless they have logic, lockfiles, minified output).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Idle-Sync](https://github.com/Idle-Sync)
- **Source:** [Idle-Sync/skills](https://github.com/Idle-Sync/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-idle-sync-skills-codebase-deep-audit
- Seller: https://agentstack.voostack.com/s/idle-sync
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.