ezos26/claude-skills/audit

{TYPECHECK_COMMAND} 2>&1 | tail -30
{TEST_COMMAND} 2>&1 | tail -50
{LINT_COMMAND} 2>&1 | tail -30   # skip if no lint script

## Agent Roster (you are Agent {N})
1. Security Auditor — auth, access control, injection, secrets, HMAC, CORS
2. Architecture Auditor — patterns, conventions, file organization, dependencies
3. Data Layer Auditor — schema, queries, indexes, migrations, tenant isolation
4. UI/UX Auditor — pages, components, accessibility, loading/error/empty states
5. Integration Auditor — cross-package wiring, type flow, env vars, contract compliance
6. Performance Auditor — N+1, pagination, unbounded queries, caching, bundle size
 
If you find something outside your domain, note it as:
  CROSS-REF [Agent N]: [what they should check]

{context block}
 
{agent roster}
 
## Your Focus: Security Audit — {SCOPE}
 
 
### OWASP Top 10 Checks
1. **Injection**: Search for raw SQL (string concatenation in queries), unvalidated user input
2. **Broken Auth**: Verify all mutations require auth, check session handling
3. **Sensitive Data Exposure**: Search for secrets in code, error messages leaking internals in production
4. **XXE/XSS**: Check for dangerouslySetInnerHTML, unescaped user content, innerHTML
5. **Broken Access Control**: Verify access control covers ALL routes/procedures, check tenant isolation
6. **Security Misconfiguration**: CSP headers, HSTS, security headers
7. **Insecure Deserialization**: Check webhook payload handling
8. **Components with Vulnerabilities**: Note any known-vulnerable dependencies
9. **Insufficient Logging**: Verify security events are logged
10. **SSRF**: Check for user-controlled URLs in server-side fetches
 
 
### Application-Specific Checks (adapt to what exists)
 
1. **Access Control**:
   - If RBAC/permissions matrix exists: list ALL routes/procedures, cross-reference against matrix, flag any NOT registered
   - If role checks exist: verify role assignments make sense (read-only vs mutation roles)
 
2. **Tenant Isolation** (if multi-tenant):
   - Is tenant scoping enforced in middleware?
   - Do all tenant-scoped tables have row-level filtering?
   - Are there queries that could leak data across tenants?
 
3. **Webhook Security** (if webhooks exist):
   - All webhooks validate signatures
   - HMAC uses crypto.timingSafeEqual (not === comparison)
   - timingSafeEqual has length guard
   - Secrets loaded from env config (not process.env directly)
 
4. **Token Handling**:
   - OAuth tokens encrypted at rest
   - No tokens in URL parameters
   - Refresh token rotation
 
5. **Rate Limiting** (if exists):
   - All public endpoints rate-limited
   - Rate limit headers returned
 
6. **CSP & Headers** (if web app):
   - Content-Security-Policy configured
   - HSTS with max-age
   - X-Content-Type-Options: nosniff
   - X-Frame-Options or frame-ancestors
 
7. **Error Handling**:
   - Production error messages are generic (no stack traces)
   - NODE_ENV guard on detailed errors
   - No error.message exposed to users in production
 
 
## OUTPUT FORMAT (MANDATORY)
SECURITY AUDIT REPORT
=====================
Scope: {scope}
Date: {date}
Risk Level: [CRITICAL/HIGH/MEDIUM/LOW]
 
Findings: {total} ({H} HIGH, {M} MEDIUM, {L} LOW)
 
HIGH:
- [H-NNN]: [title]
  File: [path:line]
  Issue: [description]
  Fix: [recommendation]
 
MEDIUM:
- [M-NNN]: [title]
  File: [path:line]
  Issue: [description]
  Fix: [recommendation]
 
LOW:
- [L-NNN]: [title]
  File: [path:line]
  Issue: [description]
  Fix: [recommendation]
 
CROSS-REF:
- [Agent N]: [what they should verify]
 
Access Control: [summary]
Tenant Isolation: [status or N/A]
Webhook Security: [all validated / gaps / N/A]
CSP Status: [configured / gaps / N/A]

{context block}
 
{agent roster}
 
## Your Focus: Architecture & Patterns — {SCOPE}
 
1. **Dependency Graph Integrity**:
   - Read package.json in each workspace package (if monorepo)
   - Verify no circular dependencies
   - Verify dependency direction matches architecture (leaf packages don't import app layer)
   - Confirm dependency graph matches AGENTS.md (if documented)
 
2. **Import Conventions**:
   - Cross-package imports use the project's alias convention (not relative paths across package boundaries)
   - Import style matches project conventions
 
3. **File Organization**:
   - Files are in the correct directories per AGENTS.md/CLAUDE.md conventions
   - No misplaced files (e.g., backend code in frontend, shared code in app-specific dirs)
 
4. **Naming Conventions**:
   - Route/file/variable naming follows project patterns
   - Consistent naming across similar concepts
 
5. **Middleware/Pipeline Chain** (if applicable):
   - Security -> auth -> business logic chain is intact
   - Each layer verified present
 
6. **Pattern Violations**:
   - Server/client boundary violations (if SSR framework)
   - Proper use of framework conventions (loading states, error boundaries, etc.)
 
## OUTPUT FORMAT (MANDATORY)
ARCHITECTURE AUDIT REPORT
=========================
Scope: {scope}
Findings: {total} ({H} HIGH, {M} MEDIUM, {L} LOW)
 
HIGH:
- [H-NNN]: [title] | [file] | [description] | [fix]
 
MEDIUM:
- [M-NNN]: [title] | [file] | [description] | [fix]
 
LOW:
- [L-NNN]: [title] | [file] | [description] | [fix]
 
CROSS-REF:
- [Agent N]: [what they should verify]
 
Dependency Graph: [CLEAN/VIOLATIONS: list]
Import Conventions: [PASS/FAIL: violations]
File Organization: [PASS/FAIL: misplaced files]
Middleware Chain: [INTACT/BROKEN/N/A: issues]

{context block}
 
{agent roster}
 
## Your Focus: Database, Schema & Data Integrity — {SCOPE}
 
1. **Schema Completeness**:
   - All tables have appropriate column types (numeric precision, enum usage, not text for structured data)
   - FK relationships with proper ON DELETE behavior
   - Tenant isolation columns on all tenant-scoped tables (if multi-tenant)
   - Timestamps (created_at, updated_at) where appropriate
   - Type helpers exported if ORM supports it
 
2. **Migration Quality** (if migrations exist):
   - Each migration wrapped in transaction
   - Idempotent (IF NOT EXISTS / IF EXISTS patterns)
   - Data migration present when changing column types
   - No destructive operations without safety (DROP with IF EXISTS)
   - Migrations numbered sequentially
 
3. **Query Patterns**:
   - ALL tenant queries include tenant filter (if multi-tenant)
   - Pagination on list queries (cursor-based preferred over offset)
   - No N+1 patterns (look for db operations inside loops)
   - Batch operations for bulk inserts
   - Proper transaction usage for multi-table operations
 
4. **Index Coverage**:
   - Composite indexes on frequently filtered columns
   - FK columns indexed
   - Columns used in WHERE/ORDER BY indexed
 
5. **Enum Consistency**:
   - DB enums match application-level enums
   - Validation schemas reference same enum values
 
## OUTPUT FORMAT (MANDATORY)
DATA LAYER AUDIT REPORT
=======================
Scope: {scope}
Findings: {total} ({H} HIGH, {M} MEDIUM, {L} LOW)
 
HIGH:
- [H-NNN]: [title] | [file:line] | [description] | [fix]
 
MEDIUM:
- [M-NNN]: [title] | [file:line] | [description] | [fix]
 
LOW:
- [L-NNN]: [title] | [file:line] | [description] | [fix]
 
CROSS-REF:
- [Agent N]: [what they should verify]
 
Schema Integrity: [PASS/PARTIAL/FAIL]
Migration Quality: [PASS/PARTIAL/FAIL/N/A]
Tenant Isolation: [PASS/PARTIAL/FAIL/N/A]
N+1 Risks: [none/list]
Index Coverage: [adequate/gaps: list]

{context block}
 
{agent roster}
 
## Your Focus: UI/UX Quality & Consistency — {SCOPE}
 
1. **Page Completeness** — for every page:
   - Has loading state (skeleton, spinner, loading.tsx, Suspense)
   - Has error boundary coverage
   - Has empty state when data list is empty
   - Has proper metadata (title, description) if SSR/SSG