code-audit

Invoke the audit with the 'all' argument to scan every production file, excluding tests, node_modules, and build output. Files are batched in groups of 6-10 and scored against the CQ1-CQ40 checklist, producing a tiered report with a prioritized fix plan.

Quick mode runs binary pass/fail checks with batches of 10 files for fast triage, while deep mode collects per-gate evidence and fix recommendations for every file. Auditing a single file always forces deep mode with full evidence.

It supports TypeScript, JavaScript, Python, PHP, and Kotlin, with dedicated stack-specific audits for NestJS, Next.js, Astro, React, Hono, Django, FastAPI, Flask, Yii, and Prisma. Generic CodeSift tools cover Express and Fastify.

The audit falls back to Grep, Read, and Glob for discovery and pattern matching, and notifies the user once. Dead-code and clone pre-scans are skipped in degraded mode, reducing automated detection coverage for CQ13 and CQ14.

Hardcoded secrets, SQL string concatenation with user input, eval() with dynamic input, unsanitized HTML reaching the DOM, unsafe pickle/yaml loading, and shell=True subprocess calls all trigger automatic Tier D. These red flags bypass the full checklist evaluation.

Use code-audit for batch triage across many production files, such as pre-release health checks or codebase onboarding. For single-file review, refactoring, or test quality assessment, the documentation directs you to the dedicated review, refactor, and test-audit skills instead.