Agent skill
codebase-auditor
Use PROACTIVELY when auditing code quality, running security scans, assessing technical debt, reviewing code for production readiness, setting up CI quality gates, or tracking DORA metrics. Analyzes codebases against OWASP Top 10, SOLID principles, Testing Trophy, and 2024-25 SDLC standards. Supports incremental audits for large codebases. Not for runtime profiling or real-time monitoring.
Install this agent skill to your Project
npx add-skill https://github.com/cskiro/claudex/tree/main/plugins/codebase-auditor/skills/codebase-auditor
SKILL.md
Codebase Auditor
Comprehensive codebase audits using modern software engineering standards with actionable remediation plans.
When to Use
- Audit codebase for quality, security, maintainability
- Assess technical debt and estimate remediation
- Prepare production readiness report
- Evaluate legacy codebase for modernization
- Set up quality gates for CI/CD pipelines
- Configure incremental audits for large codebases (>100k LOC)
- Track audit history and trends over time
Trigger Phrases
- "Audit this codebase" / "Run a code audit"
- "Security scan" / "Check for vulnerabilities"
- "Assess technical debt" / "How much tech debt?"
- "Production readiness review"
- "Set up quality gates"
- "DORA metrics" / "Deployment health"
Audit Phases
Phase 1: Initial Assessment
- Project discovery (tech stack, frameworks, tools)
- Quick health check (LOC, docs, git practices)
- Red flag detection (secrets, massive files)
Phase 2: Deep Analysis
Load on demand based on Phase 1 findings.
Phase 3: Report Generation
Comprehensive report with scores and priorities.
Phase 4: Remediation Planning
Prioritized action plan with effort estimates.
Analysis Categories
| Category | Key Checks |
|---|---|
| Code Quality | Complexity, duplication, code smells |
| Testing | Coverage (80% min), trophy distribution, quality |
| Security | OWASP Top 10, dependencies, secrets |
| Architecture | SOLID, patterns, modularity |
| Performance | Build time, bundle size, runtime |
| Documentation | JSDoc, README, ADRs |
| DevOps | CI/CD maturity, DORA metrics |
| Accessibility | WCAG 2.1 AA compliance |
Technical Debt Rating (SQALE)
| Grade | Remediation Effort |
|---|---|
| A | <= 5% of dev time |
| B | 6-10% |
| C | 11-20% |
| D | 21-50% |
| E | > 50% |
Usage Examples
# Basic audit
Audit this codebase using the codebase-auditor skill.
# Security focused
Run a security-focused audit on this codebase.
# Quick health check
Give me a quick health check (Phase 1 only).
# Custom scope
Audit focusing on test coverage and security.
Output Formats
- Markdown Report - Human-readable for PR comments
- JSON Report - Machine-readable for CI/CD
- HTML Dashboard - Interactive visualization
- Remediation Plan - Prioritized action items
Priority Levels
| Priority | Examples | Timeline |
|---|---|---|
| P1 Critical | Security vulns, data loss risks | Immediate |
| P2 High | Coverage gaps, performance issues | This sprint |
| P3 Medium | Code smells, doc gaps | Next quarter |
| P4 Low | Stylistic, minor optimizations | Backlog |
Best Practices
- Run incrementally for large codebases
- Focus on critical paths first
- Baseline before major releases
- Track metrics over time
- Integrate with CI/CD
Integrations
Complements: SonarQube, ESLint, Jest/Vitest, npm audit, Lighthouse, GitHub Actions
Limitations
- Static analysis only (no runtime profiling)
- Requires source code access
- Internet needed for CVE data
- Large codebases need chunked analysis
Additional Resources
| Resource | Path | Description |
|---|---|---|
| Audit Criteria | reference/audit_criteria.md |
Complete checklist (200+ items) |
| Severity Matrix | reference/severity_matrix.md |
Scoring rubric |
| Best Practices | reference/best_practices_2025.md |
SDLC standards |
| CI Integration | reference/ci-integration.md |
GitHub Actions workflows |
| Incremental Audit | workflow/incremental-audit.md |
Large codebase strategies |
| History Schema | templates/audit-history-schema.sql |
SQLite tracking |
| Custom Rules | data/custom-rules.yaml |
Rule template |
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
cskiro/claudex
e2e-testing
Use PROACTIVELY when setting up end-to-end testing, debugging UI issues, creating visual regression suites, or automating browser testing. Uses Playwright with LLM-powered visual analysis, screenshot capture, and fix recommendations. Zero-setup for React, Next.js, Vue, Node.js, and static sites. Not for unit testing, API-only testing, or mobile native apps.
cskiro/claudex
github-repo-setup
Use PROACTIVELY when user needs to create a new GitHub repository or set up a project with best practices. Automates repository creation with four modes - quick public repos (~30s), enterprise-grade with security and CI/CD (~120s), open-source community standards (~90s), and private team collaboration with governance (~90s). Not for existing repo configuration or GitHub Actions workflow debugging.
cskiro/claudex
sub-agent-creator
Use PROACTIVELY when creating specialized Claude Code sub-agents for task delegation. Automates agent creation following Anthropic's official patterns with proper frontmatter, tool configuration, and system prompts. Generates domain-specific agents, proactive auto-triggering agents, and security-sensitive agents with limited tools. Not for modifying existing agents or general prompt engineering.
cskiro/claudex
accessibility-audit
Use PROACTIVELY when user asks for accessibility review, a11y audit, WCAG compliance check, screen reader testing, keyboard navigation validation, or color contrast analysis. Audits React/TypeScript applications for WCAG 2.2 Level AA compliance with risk-based severity scoring. Includes MUI framework awareness to avoid false positives. Not for runtime accessibility testing in production, automated remediation, or non-React frameworks.
cskiro/claudex
otel-monitoring-setup
Use PROACTIVELY when setting up OpenTelemetry monitoring for Claude Code usage tracking, cost analysis, or productivity metrics. Provides local PoC mode (full Docker stack with Grafana) and enterprise mode (centralized infrastructure). Configures telemetry collection, imports dashboards, and verifies data flow. Not for non-Claude telemetry or custom metric definitions.
cskiro/claudex
json-outputs-implementer
Use PROACTIVELY when extracting structured data from text/images, classifying content, or formatting API responses with guaranteed schema compliance. Implements Anthropic's JSON outputs mode with Pydantic/Zod SDK integration. Covers schema design, validation, testing, and production optimization. Not for tool parameter validation or agentic workflows (use strict-tool-implementer instead).
Didn't find tool you were looking for?