SkillsAdd

smithery/cskiro

codebase-auditor

Use PROACTIVELY when auditing code quality, running security scans, assessing technical debt, reviewing code for production readiness, setting up CI quality gates, or tracking DORA metrics.

Installation

$ npx skills add smithery/cskiro --skill codebase-auditor
View on skills.sh ↗ Website ↗

Summary

  • Use PROACTIVELY when auditing code quality, running security scans, assessing technical debt, reviewing code for production readiness, setting up CI quality gates, or tracking DORA metrics.
  • Analyzes codebases against OWASP Top 10, SOLID principles, Testing Trophy, and 2024-25 SDLC standards.
  • Supports incremental audits for large codebases.
  • Not for runtime profiling or real-time monitoring.

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
azure-diagnostics Same topic
microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …

568.9K installs
azure-validate Same topic
microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure…

567.7K installs
azure-aigateway Same topic
microsoft/azure-skills

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: sem…

566.3K installs
azure-compute Same topic
microsoft/azure-skills

Azure VM/VMSS router. WHEN: create / provision / deploy / spin-up VM, recommend VM size, compar…

510K installs
supabase-postgres-best-practices Same topic
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs

Also in this package

Other skills from smithery/cskiro.

npx skills add smithery/cskiro
structured-outputs-advisor 0 strict-tool-implementer 0 mutation-testing 0 mcp-server-creator 0 insight-skill-generator 0 cc-insights 0 bulletproof-react-auditor 0 ascii-diagram-creator 0 accessibility-audit 0

Browse all from smithery/cskiro

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 4,163 B
  • docs SUMMARY.md 416 B

History

  1. First recorded snapshot · 0 installs

SKILL.md

Codebase Auditor

Comprehensive codebase audits using modern software engineering standards with actionable remediation plans.

When to Use

  • Audit codebase for quality, security, maintainability
  • Assess technical debt and estimate remediation
  • Prepare production readiness report
  • Evaluate legacy codebase for modernization
  • Set up quality gates for CI/CD pipelines
  • Configure incremental audits for large codebases (>100k LOC)
  • Track audit history and trends over time

Trigger Phrases

  • "Audit this codebase" / "Run a code audit"
  • "Security scan" / "Check for vulnerabilities"
  • "Assess technical debt" / "How much tech debt?"
  • "Production readiness review"
  • "Set up quality gates"
  • "DORA metrics" / "Deployment health"

Audit Phases

Phase 1: Initial Assessment

  • Project discovery (tech stack, frameworks, tools)
  • Quick health check (LOC, docs, git practices)
  • Red flag detection (secrets, massive files)

Phase 2: Deep Analysis

Load on demand based on Phase 1 findings.

Phase 3: Report Generation

Comprehensive report with scores and priorities.

Phase 4: Remediation Planning

Prioritized action plan with effort estimates.

Analysis Categories

Category Key Checks
Code Quality Complexity, duplication, code smells
Testing Coverage (80% min), trophy distribution, quality
Security OWASP Top 10, dependencies, secrets
Architecture SOLID, patterns, modularity
Performance Build time, bundle size, runtime
Documentation JSDoc, README, ADRs
DevOps CI/CD maturity, DORA metrics
Accessibility WCAG 2.1 AA compliance

Technical Debt Rating (SQALE)

Grade Remediation Effort
A <= 5% of dev time
B 6-10%
C 11-20%
D 21-50%
E > 50%

Usage Examples

# Basic audit
Audit this codebase using the codebase-auditor skill.

# Security focused
Run a security-focused audit on this codebase.

# Quick health check
Give me a quick health check (Phase 1 only).

# Custom scope
Audit focusing on test coverage and security.

Output Formats

  1. Markdown Report - Human-readable for PR comments
  2. JSON Report - Machine-readable for CI/CD
  3. HTML Dashboard - Interactive visualization
  4. Remediation Plan - Prioritized action items

Priority Levels

Priority Examples Timeline
P1 Critical Security vulns, data loss risks Immediate
P2 High Coverage gaps, performance issues This sprint
P3 Medium Code smells, doc gaps Next quarter
P4 Low Stylistic, minor optimizations Backlog

Best Practices

  1. Run incrementally for large codebases
  2. Focus on critical paths first
  3. Baseline before major releases
  4. Track metrics over time
  5. Integrate with CI/CD

Integrations

Complements: SonarQube, ESLint, Jest/Vitest, npm audit, Lighthouse, GitHub Actions

Limitations

  • Static analysis only (no runtime profiling)
  • Requires source code access
  • Internet needed for CVE data
  • Large codebases need chunked analysis

Additional Resources

Resource Path Description
Audit Criteria reference/audit_criteria.md Complete checklist (200+ items)
Severity Matrix reference/severity_matrix.md Scoring rubric
Best Practices reference/bestpractices2025.md SDLC standards
CI Integration reference/ci-integration.md GitHub Actions workflows
Incremental Audit workflow/incremental-audit.md Large codebase strategies
History Schema templates/audit-history-schema.sql SQLite tracking
Custom Rules data/custom-rules.yaml Rule template