Evidence-based code auditing as a Claude Skill.
Ten audit areas. Every finding cited to a line. Nothing invented to fill a template.
Ask an AI to "audit my code" and you usually get plausible generalities — advice that would apply to any codebase, and therefore tells you nothing about yours.
Auditsmith makes Claude work like an actual auditor: scope the audit to what your code really is, gather evidence with greps and targeted reading, cite file:line for every finding, rank by consequence, and state plainly what it couldn't verify.
You: audit my app before I ship it
Claude: [reads package.json, config, directory tree]
This is a React/TS app on Cloudflare Workers with auth and Stripe.
I'd scope to security, api-contract, ux, and observability.
Sound right?
- What it audits
- Install
- Use
- What makes the output different
- CI enforcement
- Other stacks
- What this can't do
- Repo structure
- Contributing
| Area | Covers |
|---|---|
| UX behavior | Async states, feedback, error handling, forms, edge cases, navigation |
| Code quality | Reuse, styling discipline, duplication, types, state architecture, dead code |
| UI | Structural (lint/grep) + rendered (Playwright/axe) + vision-model layers |
| Security | Authn/authz, IDOR, injection, secrets, SSRF, edge runtime, info leakage |
| LLM / AI | Prompt injection, output trust, cost control, privacy, reliability, evals |
| Performance | Bundle, render cost, data layer, caching, memory, edge runtime limits |
| Testing | Behavior vs implementation, pyramid shape, flakiness, risk coverage |
| Dependencies | CVEs, maintenance health, supply chain, licenses, footprint |
| Observability | Logging, error tracking, metrics, alerting, graceful degradation |
| API contract | Consistency, error shape, versioning, pagination, idempotency, validation |
Each area is a separate reference file, loaded only when it's in scope — so a security audit doesn't drag in 700 lines of unrelated checklist.
/plugin marketplace add opefyre/auditsmith
/plugin install auditsmith@auditsmithUpdates land the next time you run /plugin marketplace update.
Download auditsmith.zip (or auditsmith.skill — same contents, different extension), open it in Claude, and click Save skill.
git clone https://github.com/opefyre/auditsmith.git
cp -r auditsmith/auditsmith ~/.claude/skills/Upload auditsmith/SKILL.md and the auditsmith/references/ folder into a Claude Project.
It triggers on natural phrasing — you don't need to name the skill:
audit my app
is this production ready?
review this repo for security issues
why is this slow?
what am I missing before launch?
check my error handling
is my LLM integration safe?
Auditsmith scopes first, proposes which areas to run, then goes deep on those. It deliberately prefers three areas audited properly over ten skimmed — a report nobody reads is worth nothing.
You can also scope it yourself:
audit just the security and API contract of this backend
run the LLM checklist against my agent code
Three rules are baked into the skill, because they're what separate a useful audit from a misleading one.
file:line, the offending code, the concrete consequence, and the fix. No location, no finding.
### C1 — Missing ownership check on invoice endpoint
**Where:** `src/routes/invoices.ts:47`
**What:** Handler fetches by `params.id` with no check that the invoice
belongs to the authenticated user.
**Why it matters:** Any authenticated user can read any invoice by
incrementing the ID. Direct data breach of customer billing records.
**Fix:** Filter by `userId` from the verified token, not just the path param.Anything needing a running app, deploy access, or unavailable tooling goes in an explicit Not verified section. Silence would imply it was checked and passed — that's exactly how audits mislead the people relying on them.
A section with nothing wrong gets "no issues found." Inventing findings to fill a template destroys the signal that makes the real findings worth acting on.
Severity is ranked by consequence, not effort, and weighted by blast radius — the same pattern in an auth path outranks it in a settings page.
An audit fixed once regresses within weeks. The most valuable output is the part that becomes automated, so Auditsmith closes every report by identifying what's enforceable.
Starter implementations ship in ci/:
| File | What it does |
|---|---|
ci/audit.sh |
Grep-based checks — secrets, dangerouslySetInnerHTML, eval, tokens in localStorage, key={index}, swallowed catches, console., TODOs |
ci/eslint.config.audit.mjs |
Flat ESLint config encoding the lint-expressible findings, including jsx-a11y |
# run the grep sweep locally
bash ci/audit.sh ./src
# strict mode — non-zero exit on any critical hit, for CI
bash ci/audit.sh ./src --strictFull mapping from finding type to enforcement:
| Finding type | Enforcement |
|---|---|
Inline styles, key={index}, onClick on div, missing labels |
ESLint (jsx-a11y, core) |
any, @ts-ignore, loose types |
tsconfig strict + ESLint |
| Hardcoded colors/spacing | Stylelint |
Secrets, hardcoded URLs, console., TODOs |
ci/audit.sh |
| Vulnerable / unused / duplicate deps | npm audit, depcheck, Dependabot |
| Overflow, contrast, focus order | Playwright + axe |
| Bundle growth | bundlesize / Lighthouse CI |
| Duplication | jscpd threshold |
The reference files are React / TypeScript / Cloudflare-flavored, because that's the context the specific traps were written from. The categories are universal; the tells are not.
The skill instructs Claude to keep the section structure, translate specifics to whatever's actually in front of it, and drop what doesn't apply — rather than reporting findings just because a reference file mentions them. It works fine on Python backends, Go services, and mobile apps; those just have fewer pre-loaded stack-specific greps.
Adding references/python.md, references/go.md, or references/mobile.md is the single most useful contribution right now. See CONTRIBUTING.md.
Static and automated analysis catch broken and inconsistent. They never catch wrong — whether the architecture suits the problem, whether the flow makes sense, whether the product should exist in this shape.
Auditsmith flags that as needing human judgment rather than quietly leaving it out of scope. Use it so your human review isn't wasted on bugs a script should have caught.
auditsmith/
├── .claude-plugin/
│ └── marketplace.json # Claude Code marketplace catalog
├── auditsmith/ # the skill (also the plugin root)
│ ├── .claude-plugin/
│ │ └── plugin.json # plugin manifest
│ ├── SKILL.md # scoping → evidence → severity → report → CI
│ └── references/
│ ├── ux.md
│ ├── code-quality.md
│ ├── ui.md
│ ├── security.md
│ ├── llm-ai.md
│ ├── performance.md
│ ├── testing.md
│ ├── dependencies.md
│ ├── observability.md
│ └── api-contract.md
├── ci/
│ ├── audit.sh # grep sweep for CI
│ └── eslint.config.audit.mjs # lint rules from the checklists
├── auditsmith.skill # packaged, installable (.zip)
├── auditsmith.zip # same contents, .zip extension
├── SECURITY.md
├── CONTRIBUTING.md
├── CHANGELOG.md
└── LICENSE
SKILL.md is the workflow. The reference files are the checklists — each also reads fine standalone if you just want a list to work through by hand.
Most wanted:
- Stack-specific reference files — Python, Go, Rust, mobile
- Checklist items with a grep or lint rule attached — automatable beats aspirational
- Corrections where an item is outdated or wrong
See CONTRIBUTING.md for the format.
MIT — see LICENSE. Use it, fork it, adapt it.