Audit

Systematic code audit across multiple dimensions. Produces an actionable, severity-ranked report.

Steps

1. Determine scope

Parse $ARGUMENTS: security, performance, patterns, a11y, dead-code, deps, all (default). Optional file/directory path to narrow scope.

2. Load context

• .ccs/architecture.md → system overview
• .ccs/file-index.md → prioritize S/A-rank files first
• .ccs/conventions.md → expected patterns

3. Security audit

Grep for: SQL injection (query(.*$), command injection (exec(, spawn(, eval(), XSS (innerHTML, dangerouslySetInnerHTML), hardcoded secrets (password\s*=\s*["'], api_key), path traversal, CORS wildcards, unvalidated input. Confirm each finding by reading the file.

Production-confirmed patterns (always flag):

• innerHTML += → DOM re-parse, breaks observers/listeners. Use insertAdjacentHTML.
• fetch( without .catch( or surrounding try/catch → silent network failures.
• navigator.clipboard without .catch( → silent clipboard failures.
• DB queries outside try/catch → crashes serverless functions.
• Hardcoded email/role checks → use DB flags.
• Tokens/secrets in committed files → must be in .gitignore.
• Division without zero-guard → Infinity propagation.
• const/let used before declaration → runtime ReferenceError.

4. Performance audit

Grep for: N+1 queries (DB calls in loops), blocking I/O (readFileSync in handlers), memory leaks (listeners without cleanup), large bundle imports (import _ from 'lodash'), missing memoization, unoptimized queries (SELECT *).

5. Pattern audit

Check for: mixed naming conventions, inconsistent error handling, mixed import styles, mixed async patterns, code duplication (similar 10+ line blocks).

6. Accessibility audit (UI codebases only)

Grep for: <img without alt, buttons without accessible text, onClick without onKeyDown, missing form labels, missing role attributes.

7. Dead code detection

For each exported symbol in file-index → Grep for usage. If never imported → flag as potentially dead. Check for unreachable code, unused variables/imports, commented-out blocks.

8. Dependency audit

Read package manager files. Check for outdated versions, known vulnerabilities (npm audit / pip-audit), duplicates, missing peer deps, unused deps. WebSearch for deprecation notices.

9. Generate report

Output severity-ranked findings (Critical/High/Medium/Low/Info) with file, line, category, description, and suggested fix. Provide prioritized action items.

10. Log to .ccs/task.md

Append using template at .claude/skills/_ccs/templates/task-template.md: findings count by severity, top action items.

Rules

• S/A-rank files first — they have the highest blast radius
• Confirm each finding by reading the file (reduce false positives)
• For large codebases, scope to changed files or specific directories

Refs

• File index: .ccs/file-index.md
• Conventions: .ccs/conventions.md
• Task template: .claude/skills/_ccs/templates/task-template.md
• Strategy: .claude/skills/_ccs/references/context-strategies.md

---

10x-Code v2.0.0