{"id":"2d70fee5-e5f9-4ca0-bf69-7e4f820b4078","shortId":"87GYWX","kind":"skill","title":"audit","tagline":"Project-wide health audit pipeline that fans out to all analysis skills in parallel, evaluates findings, and produces a unified report at .turbo/audit.md. Use when the user asks to \"audit the project\", \"run a full audit\", \"project health check\", \"audit my code\", \"codebase audit\",","description":"# Audit\n\nProject-wide health audit. Fans out to all analysis skills, evaluates findings, and writes `.turbo/audit.md` and `.turbo/audit.html`. Analysis-only — does not apply fixes.\n\n## Task Tracking\n\nAt the start, use `TaskCreate` to create a task for each phase:\n\n1. Scope and partition\n2. Threat model\n3. Run analysis skills\n4. Run `/evaluate-findings` skill\n5. Generate markdown report\n6. Generate HTML report\n\n## Step 1: Scope and Partition\n\nIf `$ARGUMENTS` specifies paths, use those directly (skip the question).\n\nOtherwise, use `AskUserQuestion` to confirm scope:\n\n- **All source files** — audit everything\n- **Specific paths** — user provides directories or file patterns\n- **Critical paths** — heuristically identify high-risk areas (entry points, auth, data handling, payment processing)\n\nOnce scope is determined:\n\n1. Glob for source files in the selected scope. Exclude generated and vendored directories (`node_modules/`, `dist/`, `build/`, `vendor/`, `__pycache__/`, `.build/`, `DerivedData/`, `target/`, `.tox/`, and others appropriate to the project).\n2. Partition files by top-level source directory. Cap at 10 partitions. If more than 10 top-level directories exist, group related directories or use `AskUserQuestion` to narrow scope. If a single directory contains 50+ files, sub-partition it by its immediate subdirectories.\n\n## Step 2: Threat Model\n\nCheck if `.turbo/threat-model.md` exists. If it does, continue to Step 3.\n\nIf missing, use `AskUserQuestion` to ask whether to create one before proceeding. The security review benefits from threat model context, but creating one adds time.\n\n- **Yes** — launch an Agent tool call (`model: \"opus\"`, do not set `run_in_background`) whose prompt instructs it to invoke the `/create-threat-model` skill via the Skill tool. Wait for completion before continuing.\n- **No** — continue without a threat model.\n\n## Step 3: Launch All Analysis Agents\n\nUse the Agent tool to launch all analysis agents below in a single assistant message so they run concurrently. Each Agent call uses `model: \"opus\"` and does not set `run_in_background`. Each Agent's prompt instructs the subagent to invoke its assigned skill via the Skill tool, with the partition's file list passed in for partitioned skills.\n\nExpect (6 partitioned rows × number of partitions, plus 5 project-wide rows) Agent tool calls total. State the count explicitly when emitting the calls.\n\n### Partitioned Skills\n\nFor each skill below, launch **one Agent per partition** with the partition's file list in the prompt. Pass `(skip peer review)` annotations through to `/review-code` as an opt-out so it runs internal reviews only — `/peer-review` is scheduled as its own row to avoid duplicate codex runs.\n\n| Skill | Scope |\n|---|---|\n| `/review-code` with `correctness` (skip peer review) | File list |\n| `/review-code` with `security` (skip peer review) | File list |\n| `/review-code` with `api-usage` (skip peer review) | File list |\n| `/review-code` with `consistency` (skip peer review) | File list |\n| `/review-code` with `simplicity` (skip peer review) | File list |\n| `/peer-review` | File list |\n\n### Project-Wide Skills\n\n| Skill | Notes |\n|---|---|\n| `/review-code` with `coverage` (skip peer review) | Project-wide |\n| `/review-dependencies` | Project-wide |\n| `/review-tooling` | Project-wide |\n| `/review-agentic-setup` | Project-wide |\n| `/find-dead-code` | Has its own partitioning |\n\n## Step 4: Run `/evaluate-findings` Skill\n\nAggregate all findings from all agents. Run the `/evaluate-findings` skill once on the combined set.\n\n## Step 5: Generate Markdown Report\n\nWrite `.turbo/audit.md` using the template below. Populate the dashboard by counting findings per category and applying health thresholds. Output the dashboard as text before writing the file.\n\n### Report Template\n\n```markdown\n# Audit Report\n\n**Date:** <date>\n**Scope:** <what was audited>\n\n## Dashboard\n\n| Category | Health | Findings | Critical |\n|---|---|---|---|\n| Correctness | <Pass/Warn/Fail> | <N> | <N> |\n| Security | <Pass/Warn/Fail> | <N> | <N> |\n| API Usage | <Pass/Warn/Fail> | <N> | <N> |\n| Consistency | <Pass/Warn/Fail> | <N> | <N> |\n| Simplicity | <Pass/Warn/Fail> | <N> | <N> |\n| Test Coverage | <Pass/Warn/Fail> | <N> | <N> |\n| Dependencies | <Pass/Warn/Fail> | <N> | <N> |\n| Tooling | <Pass/Warn/Fail> | <N> | <N> |\n| Dead Code | <Pass/Warn/Fail> | <N> | <N> |\n| Agentic Setup | <Pass/Warn/Fail> | <N> | <N> |\n| Threat Model | <Present/Missing> | — | — |\n\n### Health Thresholds\n\n- **Pass** — zero P0/P1 findings in this category\n- **Warn** — P1 findings present but no P0\n- **Fail** — P0 findings present\n\n## Detailed Findings\n\n### Correctness\n<findings from /review-code correctness>\n\n### Security\n<findings from /review-code security>\n\n### API Usage\n<findings from /review-code api-usage>\n\n### Consistency\n<findings from /review-code consistency>\n\n### Simplicity\n<findings from /review-code simplicity>\n\n### Test Coverage\n<findings from /review-code coverage>\n\n### Dependencies\n<findings from /review-dependencies>\n\n### Tooling\n<findings from /review-tooling>\n\n### Dead Code\n<findings from /find-dead-code>\n\n### Agentic Setup\n<findings from /review-agentic-setup>\n\n### Threat Model\n<status and summary>\n```\n\n## Step 6: Generate HTML Report\n\nConvert the markdown report into a styled, interactive HTML page.\n\n1. Run the `/frontend-design` skill to load design principles.\n2. Read `.turbo/audit.md` for the full report content.\n3. Write a self-contained `.turbo/audit.html` (single file, no external dependencies beyond Google Fonts) that presents all findings from the markdown report with:\n   - Dashboard health grid with severity color-coding (red=Fail, amber=Warn, green=Pass)\n   - Severity summary bar (P0/P1/P2/P3 counts)\n   - Sticky navigation between report sections\n   - Collapsible category sections\n   - Finding tables with file, line, and description columns\n   - Severity badges and color-coded group labels\n   - Entrance animations and hover states\n   - Print-friendly styles via `@media print`\n   - Responsive layout for mobile\n\n## Rules\n\n- If any skill is unavailable or fails, proceed with findings from the remaining skills and note the failure in the report.\n- `/peer-review` covers all concerns (correctness, security, api-usage, consistency, simplicity, coverage). Distribute its findings into their matching category sections. Deduplicate findings that overlap with the specialized reviewers.\n- Does not modify source code, stage files, or commit.","tags":["audit","turbo","tobihagemann","agent-skills","claude-code","claude-skills","developer-tools","skills"],"capabilities":["skill","source-tobihagemann","skill-audit","topic-agent-skills","topic-claude-code","topic-claude-skills","topic-developer-tools","topic-skills"],"categories":["turbo"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/tobihagemann/turbo/audit","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add tobihagemann/turbo","source_repo":"https://github.com/tobihagemann/turbo","install_from":"skills.sh"}},"qualityScore":"0.597","qualityRationale":"deterministic score 0.60 from registry signals: · indexed on github topic:agent-skills · 295 github stars · SKILL.md body (6,490 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-08T06:54:07.036Z","embedding":null,"createdAt":"2026-04-18T22:03:26.943Z","updatedAt":"2026-05-08T06:54:07.036Z","lastSeenAt":"2026-05-08T06:54:07.036Z","tsv":"'/create-threat-model':300 '/evaluate-findings':100,540,550 '/find-dead-code':532 '/frontend-design':684 '/peer-review':446,502,803 '/review-agentic-setup':528 '/review-code':434,460,468,476,486,494,511 '/review-dependencies':520 '/review-tooling':524 '1':87,111,163,681 '10':204,209 '2':91,193,240,690 '3':94,253,318,698 '4':98,538 '5':102,390,558 '50':229 '6':106,383,667 'add':277 'agent':282,322,325,331,343,356,395,415,547,622,662 'aggreg':542 'amber':732 'analysi':13,57,67,96,321,330 'analysis-on':66 'anim':766 'annot':431 'api':479,605,652,810 'api-usag':478,809 'appli':71,577 'appropri':189 'area':151 'argument':116 'ask':30,259 'askuserquest':127,220,257 'assign':365 'assist':336 'audit':1,6,32,38,42,46,47,52,134,592 'auth':154 'avoid':454 'background':292,354 'badg':758 'bar':738 'benefit':269 'beyond':710 'build':180,183 'call':284,344,397,406 'cap':202 'categori':575,597,636,747,821 'check':41,243 'code':44,620,661,729,762,835 'codebas':45 'codex':456 'collaps':746 'color':728,761 'color-cod':727,760 'column':756 'combin':555 'commit':839 'complet':308 'concern':806 'concurr':341 'confirm':129 'consist':488,608,654,812 'contain':228,703 'content':697 'context':273 'continu':250,310,312 'convert':671 'correct':462,601,650,807 'count':401,572,740 'cover':804 'coverag':513,613,657,814 'creat':81,262,275 'critic':144,600 'dashboard':570,582,596,722 'data':155 'date':594 'dead':619,660 'dedupl':823 'depend':615,658,709 'deriveddata':184 'descript':755 'design':688 'detail':648 'determin':162 'direct':121 'directori':140,176,201,213,217,227 'dist':179 'distribut':815 'duplic':455 'emit':404 'entranc':765 'entri':152 'evalu':17,59 'everyth':135 'exclud':172 'exist':214,246 'expect':382 'explicit':402 'extern':708 'fail':644,731,788 'failur':799 'fan':9,53 'file':133,142,167,195,230,375,422,466,474,484,492,500,503,588,706,752,837 'find':18,60,544,573,599,633,639,646,649,716,749,791,817,824 'fix':72 'font':712 'friend':772 'full':37,695 'generat':103,107,173,559,668 'glob':164 'googl':711 'green':734 'grid':724 'group':215,763 'handl':156 'health':5,40,51,578,598,628,723 'heurist':146 'high':149 'high-risk':148 'hover':768 'html':108,669,679 'identifi':147 'immedi':237 'instruct':295,359 'interact':678 'intern':443 'invok':298,363 'label':764 'launch':280,319,328,413 'layout':778 'level':199,212 'line':753 'list':376,423,467,475,485,493,501,504 'load':687 'markdown':104,560,591,673,719 'match':820 'media':775 'messag':337 'miss':255 'mobil':780 'model':93,242,272,285,316,346,626,665 'modifi':833 'modul':178 'narrow':222 'navig':742 'node':177 'note':510,797 'number':386 'one':263,276,414 'opt':438 'opt-out':437 'opus':286,347 'other':188 'otherwis':125 'output':580 'overlap':826 'p0':643,645 'p0/p1':632 'p0/p1/p2/p3':739 'p1':638 'page':680 'parallel':16 'partit':90,114,194,205,233,373,380,384,388,407,417,420,536 'pass':377,427,630,735 'pass/warn/fail':602,604,607,609,611,614,616,618,621,624 'path':118,137,145 'pattern':143 'payment':157 'peer':429,464,472,482,490,498,515 'per':416,574 'phase':86 'pipelin':7 'plus':389 'point':153 'popul':568 'present':640,647,714 'present/missing':627 'principl':689 'print':771,776 'print-friend':770 'proceed':265,789 'process':158 'produc':20 'project':3,34,39,49,192,392,506,518,522,526,530 'project-wid':2,48,391,505,517,521,525,529 'prompt':294,358,426 'provid':139 'pycach':182 'question':124 'read':691 'red':730 'relat':216 'remain':794 'report':23,105,109,561,589,593,670,674,696,720,744,802 'respons':777 'review':268,430,444,465,473,483,491,499,516,830 'risk':150 'row':385,394,452 'rule':781 'run':35,95,99,290,340,352,442,457,539,548,682 'schedul':448 'scope':88,112,130,160,171,223,459,595 'section':745,748,822 'secur':267,470,603,651,808 'select':170 'self':702 'self-contain':701 'set':289,351,556 'setup':623,663 'sever':726,736,757 'simplic':496,610,655,813 'singl':226,335,705 'skill':14,58,97,101,301,304,366,369,381,408,411,458,508,509,541,551,685,784,795 'skill-audit' 'skip':122,428,463,471,481,489,497,514 'sourc':132,166,200,834 'source-tobihagemann' 'special':829 'specif':136 'specifi':117 'stage':836 'start':77 'state':399,769 'step':110,239,252,317,537,557,666 'sticki':741 'style':677,773 'sub':232 'sub-partit':231 'subag':361 'subdirectori':238 'summari':737 'tabl':750 'target':185 'task':73,83 'taskcreat':79 'templat':566,590 'test':612,656 'text':584 'threat':92,241,271,315,625,664 'threshold':579,629 'time':278 'tool':283,305,326,370,396,617,659 'top':198,211 'top-level':197,210 'topic-agent-skills' 'topic-claude-code' 'topic-claude-skills' 'topic-developer-tools' 'topic-skills' 'total':398 'tox':186 'track':74 'turbo/audit.html':65,704 'turbo/audit.md':25,63,563,692 'turbo/threat-model.md':245 'unavail':786 'unifi':22 'usag':480,606,653,811 'use':26,78,119,126,219,256,323,345,564 'user':29,138 'vendor':175,181 'via':302,367,774 'wait':306 'warn':637,733 'whether':260 'whose':293 'wide':4,50,393,507,519,523,527,531 'without':313 'write':62,562,586,699 'yes':279 'zero':631","prices":[{"id":"b10f190f-4528-4387-a2af-0c2f35d84f54","listingId":"2d70fee5-e5f9-4ca0-bf69-7e4f820b4078","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"tobihagemann","category":"turbo","install_from":"skills.sh"},"createdAt":"2026-04-18T22:03:26.943Z"}],"sources":[{"listingId":"2d70fee5-e5f9-4ca0-bf69-7e4f820b4078","source":"github","sourceId":"tobihagemann/turbo/audit","sourceUrl":"https://github.com/tobihagemann/turbo/tree/main/skills/audit","isPrimary":false,"firstSeenAt":"2026-04-18T22:03:26.943Z","lastSeenAt":"2026-05-08T06:54:07.036Z"}],"details":{"listingId":"2d70fee5-e5f9-4ca0-bf69-7e4f820b4078","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"tobihagemann","slug":"audit","github":{"repo":"tobihagemann/turbo","stars":295,"topics":["agent-skills","claude-code","claude-skills","developer-tools","skills"],"license":"mit","html_url":"https://github.com/tobihagemann/turbo","pushed_at":"2026-05-01T15:45:15Z","description":"A composable dev process for Claude Code, packaged as modular skills.","skill_md_sha":"72091a126ab8aa6a6060516f41292229cf2f273a","skill_md_path":"skills/audit/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/tobihagemann/turbo/tree/main/skills/audit"},"layout":"multi","source":"github","category":"turbo","frontmatter":{"name":"audit","description":"Project-wide health audit pipeline that fans out to all analysis skills in parallel, evaluates findings, and produces a unified report at .turbo/audit.md. Use when the user asks to \"audit the project\", \"run a full audit\", \"project health check\", \"audit my code\", \"codebase audit\", or \"comprehensive review\"."},"skills_sh_url":"https://skills.sh/tobihagemann/turbo/audit"},"updatedAt":"2026-05-08T06:54:07.036Z"}}