audit

Name: audit
Author: tobihagemann

3installs29forks

How to install audit?

tobihagemann/turbo/audit

$npx -y skills add tobihagemann/turbo --skill audit

Installs into the current project.

Summary

Project-wide health audit pipeline that fans out to all analysis skills in parallel, evaluates findings, and produces a unified report at .turbo/audit.md. Use when the user asks to \"audit the project\", \"run a full audit\", \"project health check\", \"audit my code\", \"codebas

Files · 1

View on GitHub

SKILL.md

1	# Audit
2
3	Project-wide health audit. Fans out to all analysis skills, evaluates findings, and writes `.turbo/audit.md` and `.turbo/audit.html`. Analysis-only — does not apply fixes.
4
5	## Task Tracking
6
7	At the start, use `TaskCreate` to create a task for each phase:
8
9	1. Scope and partition
10	2. Threat model
11	3. Run analysis skills
12	4. Run `/evaluate-findings` skill
13	5. Generate markdown report
14	6. Generate HTML report
15
16	## Step 1: Scope and Partition
17
18	If `$ARGUMENTS` specifies paths, use those directly (skip the question).
19
20	Otherwise, use `AskUserQuestion` to confirm scope:
21
22	- All source files — audit everything
23	- Specific paths — user provides directories or file patterns
24	- Critical paths — heuristically identify high-risk areas (entry points, auth, data handling, payment processing)
25
26	Once scope is determined:
27
28	1. Glob for source files in the selected scope. Exclude generated and vendored directories (`node_modules/`, `dist/`, `build/`, `vendor/`, `__pycache__/`, `.build/`, `DerivedData/`, `target/`, `.tox/`, and others appropriate to the project).
29	2. Partition files by top-level source directory. Cap at 10 partitions. If more than 10 top-level directories exist, group related directories or use `AskUserQuestion` to narrow scope. If a single directory contains 50+ files, sub-partition it by its immediate subdirectories.
30
31	## Step 2: Threat Model
32
33	Check if `.turbo/threat-model.md` exists. If it does, continue to Step 3.
34
35	If missing, use `AskUserQuestion` to ask whether to create one before proceeding. The security review benefits from threat model context, but creating one adds time.
36
37	- Yes — launch an Agent tool call in the foreground (`model: "opus"`) whose prompt instructs it to invoke the `/create-threat-model` skill via the Skill tool. Wait for completion before continuing.
38	- No — continue without a threat model.
39
40	## Step 3: Launch All Analysis Agents
41
42	Use the Agent tool to launch all analysis agents below in a single assistant message so they run concurrently. Run them in the foreground so all their results return in this turn. Each Agent call uses `model: "opus"`. Each Agent's prompt instructs the subagent to invoke its assigned skill via the Skill tool, with the partition's file list passed in for partitioned skills, and to treat the shared working tree and its git index as read-only — any empirical check runs in an isolated `git worktree` the agent discards afterward.
43
44	Expect (6 partitioned rows × number of partitions, plus 5 project-wide rows) Agent tool calls total. State the count explicitly when emitting the calls.
45
46	### Partitioned Skills
47
48	For each skill below, launch one Agent per partition with the partition's file list in the prompt. Pass `(skip peer review)` annotations through to `/review-code` as an opt-out so it runs internal reviews only — `/peer-review` is scheduled as its own row to avoid duplicate peer-review runs.
49
50	\| Skill \| Scope \|
51	\|---\|---\|
52	\| `/review-code` with `correctness` (skip peer review) \| File list \|
53	\| `/review-code` with `security` (skip peer review) \| File list \|
54	\| `/review-code` with `api-usage` (skip peer review) \| File list \|
55	\| `/review-code` with `consistency` (skip peer review) \| File list \|
56	\| `/review-code` with `simplicity` (skip peer review) \| File list \|
57	\| `/peer-review` \| File list \|
58
59	### Project-Wide Skills
60
61	\| Skill \| Notes \|
62	\|---\|---\|
63	\| `/review-code` with `coverage` (skip peer review) \| Project-wide \|
64	\| `/review-dependencies` \| Project-wide \|
65	\| `/review-tooling` \| Project-wide \|
66	\| `/review-agentic-setup` \| Project-wide \|
67	\| `/find-dead-code` \| Has its own partitioning \|
68
69	## Step 4: Run `/evaluate-findings` Skill
70
71	Aggregate all findings from all agents. Run the `/evaluate-findings` skill once on the combined set.
72
73	## Step 5: Generate Markdown Report
74
75	Write `.turbo/audit.md` using the template below. Populate the dashboard by counting findings per category and applying health thresholds. Output the dashboard as text before writing the file.
76
77	### Report Template
78
79	```markdown
80	# Audit Report
81
82	Date: <date>
83	Scope: <what was audited>
84
85	## Dashboard
86
87	\| Category \| Health \| Findings \| Critical \|
88	\|---\|---\|---\|---\|
89	\| Correctness \| <Pass/Warn/Fail> \| <N> \| <N> \|
90	\| Security \| <Pass/Warn/Fail> \| <N> \| <N> \|
91	\| API Usage \| <Pass/Warn/Fail> \| <N> \| <N> \|
92	\| Consistency \| <Pass/Warn/Fail> \| <N> \| <N> \|
93	\| Simplicity \| <Pass/Warn/Fail> \| <N> \| <N> \|
94	\| Test Coverage \| <Pass/Warn/Fail> \| <N> \| <N> \|
95	\| Dependencies \| <Pass/Warn/Fail> \| <N> \| <N> \|
96	\| Tooling \| <Pass/Warn/Fail> \| <N> \| <N> \|
97	\| Dead Code \| <Pass/Warn/Fail> \| <N> \| <N> \|
98	\| Agentic Setup \| <Pass/Warn/Fail> \| <N> \| <N> \|
99	\| Threat Model \| <Present/Missing>

People who liked this also viewed

6 picks

Type

audit

3installs29forks

View on GitHub

How to install audit?

tobihagemann/turbo/audit

$npx -y skills add tobihagemann/turbo --skill audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Audit
2
3	Project-wide health audit. Fans out to all analysis skills, evaluates findings, and writes `.turbo/audit.md` and `.turbo/audit.html`. Analysis-only — does not apply fixes.
4
5	## Task Tracking
6
7	At the start, use `TaskCreate` to create a task for each phase:
8
9	1. Scope and partition
10	2. Threat model
11	3. Run analysis skills
12	4. Run `/evaluate-findings` skill
13	5. Generate markdown report
14	6. Generate HTML report
15
16	## Step 1: Scope and Partition
17
18	If `$ARGUMENTS` specifies paths, use those directly (skip the question).
19
20	Otherwise, use `AskUserQuestion` to confirm scope:
21
22	- All source files — audit everything
23	- Specific paths — user provides directories or file patterns
24	- Critical paths — heuristically identify high-risk areas (entry points, auth, data handling, payment processing)
25
26	Once scope is determined:
27
28	1. Glob for source files in the selected scope. Exclude generated and vendored directories (`node_modules/`, `dist/`, `build/`, `vendor/`, `__pycache__/`, `.build/`, `DerivedData/`, `target/`, `.tox/`, and others appropriate to the project).
29	2. Partition files by top-level source directory. Cap at 10 partitions. If more than 10 top-level directories exist, group related directories or use `AskUserQuestion` to narrow scope. If a single directory contains 50+ files, sub-partition it by its immediate subdirectories.
30
31	## Step 2: Threat Model
32
33	Check if `.turbo/threat-model.md` exists. If it does, continue to Step 3.
34
35	If missing, use `AskUserQuestion` to ask whether to create one before proceeding. The security review benefits from threat model context, but creating one adds time.
36
37	- Yes — launch an Agent tool call in the foreground (`model: "opus"`) whose prompt instructs it to invoke the `/create-threat-model` skill via the Skill tool. Wait for completion before continuing.
38	- No — continue without a threat model.
39
40	## Step 3: Launch All Analysis Agents
41
42	Use the Agent tool to launch all analysis agents below in a single assistant message so they run concurrently. Run them in the foreground so all their results return in this turn. Each Agent call uses `model: "opus"`. Each Agent's prompt instructs the subagent to invoke its assigned skill via the Skill tool, with the partition's file list passed in for partitioned skills, and to treat the shared working tree and its git index as read-only — any empirical check runs in an isolated `git worktree` the agent discards afterward.
43
44	Expect (6 partitioned rows × number of partitions, plus 5 project-wide rows) Agent tool calls total. State the count explicitly when emitting the calls.
45
46	### Partitioned Skills
47
48	For each skill below, launch one Agent per partition with the partition's file list in the prompt. Pass `(skip peer review)` annotations through to `/review-code` as an opt-out so it runs internal reviews only — `/peer-review` is scheduled as its own row to avoid duplicate peer-review runs.
49
50	\| Skill \| Scope \|
51	\|---\|---\|
52	\| `/review-code` with `correctness` (skip peer review) \| File list \|
53	\| `/review-code` with `security` (skip peer review) \| File list \|
54	\| `/review-code` with `api-usage` (skip peer review) \| File list \|
55	\| `/review-code` with `consistency` (skip peer review) \| File list \|
56	\| `/review-code` with `simplicity` (skip peer review) \| File list \|
57	\| `/peer-review` \| File list \|
58
59	### Project-Wide Skills
60
61	\| Skill \| Notes \|
62	\|---\|---\|
63	\| `/review-code` with `coverage` (skip peer review) \| Project-wide \|
64	\| `/review-dependencies` \| Project-wide \|
65	\| `/review-tooling` \| Project-wide \|
66	\| `/review-agentic-setup` \| Project-wide \|
67	\| `/find-dead-code` \| Has its own partitioning \|
68
69	## Step 4: Run `/evaluate-findings` Skill
70
71	Aggregate all findings from all agents. Run the `/evaluate-findings` skill once on the combined set.
72
73	## Step 5: Generate Markdown Report
74
75	Write `.turbo/audit.md` using the template below. Populate the dashboard by counting findings per category and applying health thresholds. Output the dashboard as text before writing the file.
76
77	### Report Template
78
79	```markdown
80	# Audit Report
81
82	Date: <date>
83	Scope: <what was audited>
84
85	## Dashboard
86
87	\| Category \| Health \| Findings \| Critical \|
88	\|---\|---\|---\|---\|
89	\| Correctness \| <Pass/Warn/Fail> \| <N> \| <N> \|
90	\| Security \| <Pass/Warn/Fail> \| <N> \| <N> \|
91	\| API Usage \| <Pass/Warn/Fail> \| <N> \| <N> \|
92	\| Consistency \| <Pass/Warn/Fail> \| <N> \| <N> \|
93	\| Simplicity \| <Pass/Warn/Fail> \| <N> \| <N> \|
94	\| Test Coverage \| <Pass/Warn/Fail> \| <N> \| <N> \|
95	\| Dependencies \| <Pass/Warn/Fail> \| <N> \| <N> \|
96	\| Tooling \| <Pass/Warn/Fail> \| <N> \| <N> \|
97	\| Dead Code \| <Pass/Warn/Fail> \| <N> \| <N> \|
98	\| Agentic Setup \| <Pass/Warn/Fail> \| <N> \| <N> \|
99	\| Threat Model \| <Present/Missing>

People who liked this also viewed

6 picks

Type