# Code Audit

> Reviews a codebase for bugs, design issues, and code cleanliness problems with specific file paths and line numbers. Use when auditing code quality, finding bugs, doing a code review, finding problems, or reviewing a project for issues. Creates issue files in `.issues/` directory.

- **Type:** Skill
- **Install:** `agentstack add skill-philoserf-claude-code-config-code-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [philoserf](https://agentstack.voostack.com/s/philoserf)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [philoserf](https://github.com/philoserf)
- **Source:** https://github.com/philoserf/claude-code-config/tree/main/skills/code-audit

## Install

```sh
agentstack add skill-philoserf-claude-code-config-code-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

Review this codebase for bugs, design issues, and code cleanliness problems. Be specific and cite file paths and line numbers.

Scope the review to `$ARGUMENTS` if provided, otherwise review the entire project. Examples: `src/auth/`, `lib/api.ts`, `security`, `tests/`.

## What to look for

Prioritize by severity:

| Severity     | Category                                                  |
| ------------ | --------------------------------------------------------- |
| **Critical** | Security vulnerabilities, data loss, crashes              |
| **High**     | Correctness bugs, missing error handling, race conditions |
| **Medium**   | Design issues, code smells, missing validation            |
| **Low**      | Style inconsistencies, naming, minor cleanup              |

## Process

For each issue found:

1. Check for duplicates in both GitHub issues (`gh issue list`) and the local `.issues/` directory
2. Skip if a matching issue already exists
3. Otherwise, create a markdown file in `.issues/` with a descriptive kebab-case filename

Each issue file should follow this format:

```text
# Title

**Severity:** critical | high | medium | low
**Location:** `file:line`

## Description

What's wrong and why it matters.

## Suggested fix

Concrete recommendation.
```

## Summary

After creating all issue files, output a summary:

```text
| # | Severity | File:Line | Issue |
|---|----------|-----------|-------|
| 1 | high     | src/a.ts:42 | Missing null check |
| 2 | medium   | lib/b.py:17 | Bare except clause |

Total: {N} issues ({critical} critical, {high} high, {medium} medium, {low} low)
Files created in .issues/
```

## Do not use when

- Reviewing harness customizations (skills, hooks, agents) — use `cc-review`
- Reviewing a specific staged or branch diff — use `diff-review`
- Building a prioritized backlog across the whole project — use `tech-debt`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [philoserf](https://github.com/philoserf)
- **Source:** [philoserf/claude-code-config](https://github.com/philoserf/claude-code-config)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-philoserf-claude-code-config-code-audit
- Seller: https://agentstack.voostack.com/s/philoserf
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.