# Audit

> A Claude skill from waitdeadai/minmaxing.

- **Type:** Skill
- **Install:** `agentstack add skill-waitdeadai-minmaxing-audit`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [waitdeadai](https://agentstack.voostack.com/s/waitdeadai)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [waitdeadai](https://github.com/waitdeadai)
- **Source:** https://github.com/waitdeadai/minmaxing/tree/main/.claude/skills/audit

## Install

```sh
agentstack add skill-waitdeadai-minmaxing-audit
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# /audit

Deep codebase analysis with parallel agents. Audit any repo to understand its structure, identify issues, and plan improvements.

**TASTE-FIRST** — Reads taste.md + vision before audit research. Gates on misalignment.

**MAX_PARALLEL_AGENTS** — ceiling for parallel audit tracks. Choose a risk-based budget that covers the repo without redundant tracks.

**Use when:** User says "audit this", "analyze codebase", "understand this repo", "due diligence on this code", "swarm audit".

**Swarm:** "swarm audit" → `/audit` with a risk-based audit wave up to `MAX_PARALLEL_AGENTS`.

---

## Execution Protocol

### Phase 0: Taste Check [GATE]
1. Check: taste.md + taste.vision exist?
   - If NO → invoke `/tastebootstrap` → wait → proceed
2. Read taste.md + taste.vision
3. Call memory recall:
   - `bash scripts/memory.sh recall "" --depth simple`
4. Score: does the audit target align with taste?
   - If misaligned → /align before proceeding
   - If aligned → proceed to Phase 1

### Phase 1: Decompose Audit (use MAX_PARALLEL_AGENTS)

**Break the audit into parallel tracks that materially improve coverage:**

| Track | Focus | Always? | Output |
|-------|-------|---------|--------|
| 1 | Project structure & architecture | Yes | File tree, tech stack |
| 2 | Security audit | Yes | Vulnerabilities, secrets, auth |
| 3 | Correctness & code quality | Yes | Patterns, debt, complexity |
| 4 | Tests & verification surface | Yes | Missing tests, confidence gaps |
| 5 | Dependencies | If relevant | Outdated or risky packages |
| 6 | Documentation & contracts | If relevant | Drift, missing docs |
| 7 | Business logic | If relevant | Domain-specific risks |
| 8 | Performance | If relevant | Hot spots, inefficiencies |
| 9 | Git history | If relevant | Churn, ownership, risky areas |
| 10 | Compliance / policy | If relevant | Standards gaps |

### Phase 2: Parallel Execution

Spawn agents only for the tracks the repo actually needs. Give each track a clear surface and return format.

```bash
# Agent 1: Structure
claude -p "Analyze project structure. File tree, tech stack, framework. Output: structured summary" > audit-structure.out 2>&1 &

# Agent 2: Security
claude -p "Audit for security issues: SQL injection, XSS, secrets in code, auth flaws. Output: vulnerability list" > audit-security.out 2>&1 &

# ... up to MAX_PARALLEL_AGENTS
```

### Phase 3: Synthesize Findings

Before final recommendations, run `/introspect pre-plan` inline as a hard gate.

Check for:
- hidden assumptions in the audit scope
- missed high-risk files or subsystems
- evidence gaps behind severe findings
- weak or uncited claims
- places where security, tests, docs, or dependencies were skipped too quickly

If introspection returns `FIX_REQUIRED`, gather the missing evidence before publishing the audit. If it returns `REPLAN_REQUIRED` or `BLOCKED`, say why and do not present the recommendation as final.

```markdown
## Audit Report: [Repository Name]

### Executive Summary
[2-3 sentences on overall health]

### Project Structure
| Component | Technology | Status |
|-----------|------------|--------|
| API | Node.js | 🟢 |

### Security Findings
| Issue | Severity | Location |
|-------|----------|----------|
| Hardcoded API key | CRITICAL | config.js:5 |

### Code Quality
| Metric | Value |
|--------|-------|
| Files | N |
| Complexity | HIGH/MEDIUM/LOW |

### Action Items
1. [P0] Remove hardcoded secrets
2. [P1] Add authentication middleware

### Recommendation
[PROCEED/CAUTION/STOP]
```

---

## Audit Focus Options

### Quick Audit (3 agents)
- Structure + Security + Quality

### Standard Audit (6 agents)
- Structure, Security, Quality, Dependencies, Tests, Docs

### Deep Audit (up to 10 agents)
- Core tracks plus any optional tracks justified by repo risk or task scope

---

## Quality Gates

- **Cite specific files/lines** — no vague "probably insecure"
- **Severity classification** — CRITICAL/HIGH/MEDIUM/LOW
- **Actionable recommendations** — not just "this is bad"
- **Evidence-based** — show the code that triggered finding
- **Introspection gate** — final recommendations require a pre-plan self-audit for hidden assumptions, missed risk surfaces, and evidence gaps

---

## Anti-Patterns

- Vague findings without file references → BLOCK
- No severity ranking → BLOCK
- No actionable next steps → BLOCK
- Sequential execution when distinct high-value tracks exist → BLOCK
- Inflating the audit with low-value filler tracks → BLOCK
- Skipping security for speed → BLOCK (always audit security)
- Publishing final recommendations with unresolved `/introspect` blockers → BLOCK

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [waitdeadai](https://github.com/waitdeadai)
- **Source:** [waitdeadai/minmaxing](https://github.com/waitdeadai/minmaxing)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-waitdeadai-minmaxing-audit
- Seller: https://agentstack.voostack.com/s/waitdeadai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.