audit

Name: audit
Author: Rune-kit

80stars21forks

How to install audit?

rune-kit/rune/audit

$curl -o .claude/agents/audit.md https://raw.githubusercontent.com/Rune-kit/rune/HEAD/agents/audit.md

Installs into the current project.

Summary

Comprehensive 8-dimension project health audit — dependencies, security, code quality, architecture, performance, infrastructure, documentation, mesh analytics. Produces AUDIT-REPORT.md.

Files · 1

View on GitHub

agents/audit.md

1	# audit
2
3	## Purpose
4
5	Comprehensive project health audit across 8 dimensions (7 project + 1 mesh analytics). Delegates security scanning to `sentinel`, dependency analysis to `dependency-doctor`, and code complexity to `autopsy`, then directly audits architecture, performance, infrastructure, and documentation. Applies framework-specific checks (React/Next.js, Node.js, Python, Go, Rust, React Native/Flutter) based on detected stack. Produces a consolidated health score and prioritized action plan saved to `AUDIT-REPORT.md`.
6
7	## Triggers
8
9	- `/rune audit` — full 8-dimension project health audit
10	- `/rune audit dx` — DX Review Mode (Addy Osmani 8 principles, see below)
11	- User says "audit", "review project", "health check", "project assessment"
12	- User says "developer experience", "DX audit", "onboarding experience", "time to hello world"
13
14	## Calls (outbound)
15
16	- `scout` (L2): Phase 0 — project structure and stack discovery
17	- `dependency-doctor` (L3): Phase 1 — vulnerability scan and outdated dependency check
18	- `sentinel` (L2): Phase 2 — security audit (OWASP Top 10, secrets, config)
19	- `autopsy` (L2): Phase 3 — code quality and complexity assessment
20	- `improve-architecture` (L2): Phase 3.5 — architecture sub-score (depth / leverage / locality across top modules)
21	- `perf` (L2): Phase 4 — performance regression check
22	- `db` (L2): Phase 5 — database health dimension (schema, migrations, indexes)
23	- `journal` (L3): record audit date, overall score, and verdict
24	- `constraint-check` (L3): audit HARD-GATE compliance across project skills
25	- `sast` (L3): Phase 2 — deep static analysis (Semgrep, Bandit, ESLint security rules)
26	- `retro` (L2): Phase 6 — engineering velocity and health dimension (rune:retro)
27	- `browser-pilot` (L3): DX Review Mode — real browser testing of docs, setup guides, error pages
28
29	## Called By (inbound)
30
31	- `cook` (L1): pre-implementation audit gate
32	- `launch` (L1): pre-launch health check
33	- User: `/rune audit` direct invocation
34
35	## Executable Instructions
36
37	### Phase 0: Project Discovery
38
39	Call `rune:scout` for a full project map. Then use `Read` on:
40	- `README.md`, `CLAUDE.md`, `CONTRIBUTING.md`, `.editorconfig` (if they exist)
41
42	Determine:
43	- Language(s) and version(s)
44	- Framework(s) — determines which Framework-Specific Checks below apply
45	- Package manager, build tool(s), test framework(s), linter/formatter config
46	- Project type: `API/backend` \| `frontend/SPA` \| `fullstack` \| `CLI tool` \| `library` \| `mobile` \| `infra/IaC`
47	- Monorepo setup (workspaces, turborepo, nx, etc.)
48
49	Output before proceeding: Brief project profile, stack summary, and which Framework-Specific Checks will be applied.
50
51	### Phase 0.5: Context-Building (Pure Understanding)
52
53	<HARD-GATE>
54	This phase is FORBIDDEN from producing findings. No BLOCKs, no WARNs, no issues. Context-building only.
55	Rushed context = hallucinated vulnerabilities. Slow is fast.
56	</HARD-GATE>
57
58	For each critical module (entry points, auth, data layer, core business logic):
59	1. Read line-by-line. Note at minimum:
60	- 3 invariants: What MUST always be true for this code to work? (e.g., "user is authenticated before reaching this handler")
61	- 5 assumptions: What does this code assume about its inputs, environment, and callers?
62	- 3 risks: What could break if assumptions are violated?
63	2. Record findings as context notes — these feed into Phases 1-7, NOT into the final report directly
64
65	Why: Without this phase, the auditor pattern-matches against known vulnerability lists and hallucinates findings that don't exist in THIS specific codebase. The invariants + assumptions ground all later analysis in reality.
66
67	---
68
69	### Phase 1: Dependency Audit
70
71	Delegate to `dependency-doctor`. The dependency-doctor report covers:
72	- Vulnerability scan (CVEs by severity)
73	- Outdated packages (patch / minor / major)
74	- Unused dependencies
75	- Dependency health score
76
77	Pass the full dependency-doctor report through to the final audit.
78
79	---
80
81	### Phase 2: Security Audit
82
83	Delegate to `sentinel`. Request a full security scan covering:
84	- Hardcoded secrets, API keys, tokens, passwords in source code
85	- OWASP Top 10: injection, broken auth, sensitive data exposure, XSS, CSRF, insecure deserialization, broken access control
86	- Configuration security (debug mode in prod, CORS `*`, missing HTTP security headers)
87	- Input validation at API boundaries
88	- `.gitignore` coverage of sensitive files
89
90	Pass the full sentinel report through to the final audit.
91
92	---
93
94	### Phase

People who liked this also viewed

6 picks

Type

audit

80stars21forks

View on GitHub

How to install audit?

rune-kit/rune/audit

$curl -o .claude/agents/audit.md https://raw.githubusercontent.com/Rune-kit/rune/HEAD/agents/audit.md

Installs into the current project.

Summary

Comprehensive 8-dimension project health audit — dependencies, security, code quality, architecture, performance, infrastructure, documentation, mesh analytics. Produces AUDIT-REPORT.md.

Files · 1

View on GitHub

agents/audit.md

1	# audit
2
3	## Purpose
4
5	Comprehensive project health audit across 8 dimensions (7 project + 1 mesh analytics). Delegates security scanning to `sentinel`, dependency analysis to `dependency-doctor`, and code complexity to `autopsy`, then directly audits architecture, performance, infrastructure, and documentation. Applies framework-specific checks (React/Next.js, Node.js, Python, Go, Rust, React Native/Flutter) based on detected stack. Produces a consolidated health score and prioritized action plan saved to `AUDIT-REPORT.md`.
6
7	## Triggers
8
9	- `/rune audit` — full 8-dimension project health audit
10	- `/rune audit dx` — DX Review Mode (Addy Osmani 8 principles, see below)
11	- User says "audit", "review project", "health check", "project assessment"
12	- User says "developer experience", "DX audit", "onboarding experience", "time to hello world"
13
14	## Calls (outbound)
15
16	- `scout` (L2): Phase 0 — project structure and stack discovery
17	- `dependency-doctor` (L3): Phase 1 — vulnerability scan and outdated dependency check
18	- `sentinel` (L2): Phase 2 — security audit (OWASP Top 10, secrets, config)
19	- `autopsy` (L2): Phase 3 — code quality and complexity assessment
20	- `improve-architecture` (L2): Phase 3.5 — architecture sub-score (depth / leverage / locality across top modules)
21	- `perf` (L2): Phase 4 — performance regression check
22	- `db` (L2): Phase 5 — database health dimension (schema, migrations, indexes)
23	- `journal` (L3): record audit date, overall score, and verdict
24	- `constraint-check` (L3): audit HARD-GATE compliance across project skills
25	- `sast` (L3): Phase 2 — deep static analysis (Semgrep, Bandit, ESLint security rules)
26	- `retro` (L2): Phase 6 — engineering velocity and health dimension (rune:retro)
27	- `browser-pilot` (L3): DX Review Mode — real browser testing of docs, setup guides, error pages
28
29	## Called By (inbound)
30
31	- `cook` (L1): pre-implementation audit gate
32	- `launch` (L1): pre-launch health check
33	- User: `/rune audit` direct invocation
34
35	## Executable Instructions
36
37	### Phase 0: Project Discovery
38
39	Call `rune:scout` for a full project map. Then use `Read` on:
40	- `README.md`, `CLAUDE.md`, `CONTRIBUTING.md`, `.editorconfig` (if they exist)
41
42	Determine:
43	- Language(s) and version(s)
44	- Framework(s) — determines which Framework-Specific Checks below apply
45	- Package manager, build tool(s), test framework(s), linter/formatter config
46	- Project type: `API/backend` \| `frontend/SPA` \| `fullstack` \| `CLI tool` \| `library` \| `mobile` \| `infra/IaC`
47	- Monorepo setup (workspaces, turborepo, nx, etc.)
48
49	Output before proceeding: Brief project profile, stack summary, and which Framework-Specific Checks will be applied.
50
51	### Phase 0.5: Context-Building (Pure Understanding)
52
53	<HARD-GATE>
54	This phase is FORBIDDEN from producing findings. No BLOCKs, no WARNs, no issues. Context-building only.
55	Rushed context = hallucinated vulnerabilities. Slow is fast.
56	</HARD-GATE>
57
58	For each critical module (entry points, auth, data layer, core business logic):
59	1. Read line-by-line. Note at minimum:
60	- 3 invariants: What MUST always be true for this code to work? (e.g., "user is authenticated before reaching this handler")
61	- 5 assumptions: What does this code assume about its inputs, environment, and callers?
62	- 3 risks: What could break if assumptions are violated?
63	2. Record findings as context notes — these feed into Phases 1-7, NOT into the final report directly
64
65	Why: Without this phase, the auditor pattern-matches against known vulnerability lists and hallucinates findings that don't exist in THIS specific codebase. The invariants + assumptions ground all later analysis in reality.
66
67	---
68
69	### Phase 1: Dependency Audit
70
71	Delegate to `dependency-doctor`. The dependency-doctor report covers:
72	- Vulnerability scan (CVEs by severity)
73	- Outdated packages (patch / minor / major)
74	- Unused dependencies
75	- Dependency health score
76
77	Pass the full dependency-doctor report through to the final audit.
78
79	---
80
81	### Phase 2: Security Audit
82
83	Delegate to `sentinel`. Request a full security scan covering:
84	- Hardcoded secrets, API keys, tokens, passwords in source code
85	- OWASP Top 10: injection, broken auth, sensitive data exposure, XSS, CSRF, insecure deserialization, broken access control
86	- Configuration security (debug mode in prod, CORS `*`, missing HTTP security headers)
87	- Input validation at API boundaries
88	- `.gitignore` coverage of sensitive files
89
90	Pass the full sentinel report through to the final audit.
91
92	---
93
94	### Phase

People who liked this also viewed

6 picks

Type