skills.rest
Andresch2
Andresch2COMMUNITY
Explore all skills by this author →
GitHub

code-auditing

Identifies security vulnerabilities, dead code, and performance issues in a codebase during reviews.

Updated Feb 13, 2026
Search Tags:#static analysis#best practices#security review#code auditing#dead code detection#prioritized remediation
One-click install
npx skills add https://github.com/Andresch2/Workflows --skill code-auditing-andresch2
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-auditing
Source: https://github.com/Andresch2/Workflows/tree/main/ai-specs/skills/code-auditing
Command: npx skills add https://github.com/Andresch2/Workflows --skill code-auditing-andresch2

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It solves the problem of missing critical quality, security, and maintainability issues during code review by providing a repeatable, phased auditing workflow.

Core Features & Use Cases

  • Comprehensive audit phases: guides setup, discovery, file-by-file analysis, best-practices verification, pattern detection, and report generation.
  • Security and quality coverage: checks for vulnerabilities (e.g., injection risks, missing validation), dead code, performance issues, type-safety gaps, async/promise mistakes, and error-handling problems.
  • Verified findings emphasis: explicitly instructs confirming tool results to reduce false positives caused by dynamic imports, framework patterns, re-exports, entry points, and reflection/string-based access.
  • Actionable output: produces an executive summary, prioritized issues (critical through quick wins), effort estimates, and library recommendations with replacement/migration guidance.

Quick Start

Apply the code-auditing skill to the repository you want to review and generate a prioritized audit report covering security, dead code, best practices, and technical debt.

Frequently Asked Questions about code-auditing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a systematic security review on an existing codebase?▼

A systematic security review identifies vulnerabilities, dead code, and performance issues through a phased workflow. This includes discovery, file-by-file analysis, best-practices verification, and prioritized reporting to ensure comprehensive coverage.

What is the best way to find dead code and technical debt before a release?▼

Finding dead code and technical debt before a release requires structured code auditing that uses tool-assisted detection. It explicitly verifies results to reduce false positives from dynamic imports and reflection, producing an actionable report with effort estimates.

How do I check my project for security vulnerabilities and best-practice deviations?▼

Checking for security vulnerabilities and best-practice deviations involves a comprehensive audit. This process detects injection risks, missing validation, type-safety gaps, and async mistakes, generating an executive summary with prioritized issues.

Can I perform a comprehensive file-by-file quality assessment across multiple frameworks?▼

Yes, a comprehensive file-by-file quality assessment can be performed across multiple languages and frameworks. It fits scenarios like pre-release reviews and technical debt discovery, checking pattern detection and error-handling problems systematically.

How do I reduce false positives during static analysis of dynamic imports and framework patterns?▼

Reducing false positives during static analysis requires explicitly confirming tool results. This verification step accounts for dynamic imports, framework patterns, re-exports, entry points, and reflection to ensure reported vulnerabilities are accurate.

How do I generate an actionable remediation plan for library replacements and dependency health?▼

Generating an actionable remediation plan for dependency health involves auditing libraries and producing prioritized recommendations. The output includes critical issues, quick wins, effort estimates, and specific migration guidance for library replacements.

Related Skills

Explore More Software Engineering Skills→
vigoliumvigolium
965

semgrep

Run Semgrep static analysis with parallel execution and merged SARIF output.

Official
Advanced
dvy1987dvy1987
3

technical-debt-audit

Scan codebases for debt indicators and generate a prioritized remediation roadmap.

Community
Advanced
robotijnrobotijn
3

dead-code-detector

Detect unused, unreachable, and orphaned code across 7 programming languages and SQL databases.

Community
Advanced
DevHive1DevHive1
18

security_scan

Orchestrate dependency, static analysis, and privacy dataflow scanners into prioritized reports.

Community
Advanced