audit

Run the audit skill with an optional lens hint like "security review" or "find bugs". It dispatches parallel researchers across correctness, security, performance, maintainability, and reliability lenses, then consolidates results into a severity-ranked findings report without modifying any code.

depth:standard runs a single wave of five lens researchers for quick scans of in-progress work. depth:deep adds blast-radius tier gating, a STRIDE trust-boundary analysis, three blinded adversarial lenses, rollback rehearsal with blocking findings, and a persistent findings ledger for pre-PR review.

No, the audit skill is strictly report-only and never modifies code. After reviewing the findings report, you hand the summary to the build, debug, or polish skills to implement the fixes.

Yes, use scope:branch to audit only files changed relative to the merge base, or scope:working for uncommitted changes. Bounded scopes automatically run blast-radius analysis to include downstream files impacted by your changes.

Findings are capped when the asserted severity exceeds the evidence quality. A Critical claim backed only by a heuristic pattern drops to Low (Advisory), while a reproducing test or traced attack path supports higher tiers. The original severity and cap reason are preserved in the report.

Skip audit when you have a single known bug (use debug instead), when building new functionality (use build), or when you want findings fixed automatically. Audit only locates and reports problems across multiple files and concern categories.