audit-code

What This Skill Does

The audit-code skill is a sophisticated, multi-agent orchestrator designed to simulate an elite technical review board. Unlike standard static analysis tools that look for syntax errors or basic linting issues, this skill performs a deep, cross-functional audit. By simulating six distinct specialist roles—Security, Performance, UX, DX, and an Edge-Case Master—the agent evaluates your codebase against business-critical invariants, security trust boundaries, and user experience flows. It utilizes a strict, two-pass workflow that ensures consensus through a Tie-Breaker Lead, resulting in a single, high-fidelity report that ranks findings by severity, blast radius, and exploitability. This skill turns complex architectural reviews into actionable remediation plans.

Installation

To install this skill, use the ClawHub CLI inside your OpenClaw environment: clawhub install openclaw/skills/skills/swader/agent-skills-audit

Use Cases

• Pre-Launch Security Audit: Stress-testing core authentication flows, data-link integrity, and input/transport security before a production release.
• Legacy Refactoring: Identifying technical debt, performance bottlenecks, and poor developer experience (DX) patterns in aging modules.
• PR Review Integration: Utilizing the agent to perform an automated "adversarial review" on large pull requests to catch logical errors or edge cases human reviewers might miss.
• Performance Tuning: Analyzing high-traffic API endpoints, database queries, and background job chains for efficiency and resource leakage.

Example Prompts

1. "Audit the /api/v1/billing directory. I'm concerned about potential race conditions in our invoice generation logic and want a full security review of the auth decorators."
2. "Perform a deep-dive audit on the user-onboarding flow. Check for UX friction points, potential performance bottlenecks in the database queries, and verify that our input validation covers all edge cases for malicious strings."
3. "Stress-test our current Kafka-based webhook architecture. We need to identify any missing invariant checks and assess if our current retry logic creates security or consistency risks."

Tips & Limitations

• Context is King: The quality of the output is directly proportional to the context you provide. Always supply audit-framework.md or similar documentation to guide the agent.
• Assume Assumptions: If you don't provide specs, the agent will make assumptions. Always review the 'Open Questions/Assumptions' section of the report carefully.
• Scope Management: For massive repositories, scope your requests to specific modules or directories to allow the agent to allocate enough tokens for deep analysis rather than shallow surface checks.
• Review Required: While the Tie-Breaker lead is highly capable, all generated remediation code should be verified by a senior human engineer before being merged into the master branch.