codebase-audit
Made by JeffDomain-parameterized codebase auditing (security, UX, performance, API, copy, CLI). Use when auditing code, assessing quality, finding issues, or pre-launch review.
Works With
Quality and Utility come from canonical skill metadata. Community ratings appear separately as stars when subscriber reviews exist.
Subscribe to download
Public previews are available, but downloads, CLI sync, and premium content require an active subscription.
Sign In to Subscribe- Full skill content with deterministic versioning
- CLI sync + local search index
- Access to Jeffrey’s premium library
Save to your account
Saved skills live in your cloud list. Run jsm sync on each machine to pull them locally.
What's New with this Skill
1Updates, enhancements, and release notes for this skill.
New: Codebase Audit, six domain lenses (security, UX, performance, API, copy, CLI) on one repo
Different domains need different lenses. A security audit looks for injection; a UX audit looks for confusion; an API audit looks at naming, status codes, pagination, and versioning. This skill is the parameterized prompt: pick a domain, get a prioritized report with severity, file:line citations, root-cause analysis, and a recommended fix per finding.
- Six domains: security, UX, performance, API, copy, CLI. Each has its own checklist, security also gets ready-made grep patterns, and one shared severity rubric (Critical/High/Medium/Low) applies to all
- Output shape is invariant across domains: file:line, severity, root cause, fix. Lets you pipe the report into ticketing or fold it into a multi-pass bug hunt
- Quick multi-domain sweep: top 3 per domain, under 100 lines total. Useful as a pre-launch smell test before committing to a full per-domain audit
- Composes with multi-pass-bug-hunting (the audit produces the queue; the bug hunt drains it) and ux-audit (the UX domain is a deeper lens)
- Domain table at a glance: each row names the key question the audit asks ("Can attackers exploit this?" "Is this confusing?" "Is this slow?") so the right domain is obvious
The contract is the same for every domain (file path and line numbers, severity Critical/High/Medium/Low, root cause, recommended fix), so the output is consumable by any downstream tool: ticketing, code review, regression suite. The domain choice swaps the checklist and the named patterns the agent looks for.
Quick multi-domain sweep is a built-in mode: "top 3 issues across security, performance, api; total under 100 lines." Useful before launch when you want a smell test across several lenses without committing to a full audit per domain.