Code Audit Skill

Purpose

Perform a thorough, language-agnostic audit of a codebase or subset of files, producing a structured report with findings ranked by severity. Deliver the report as a self-contained file at the project root in the format the user chose (see "Report Format" below): HTML following references/report-template-html.md, or Markdown following references/report-template.md.

Effort Level

Read every line of in-scope code. Do not skim, sample, or rely on heuristics to skip files. Trace data flows from external inputs through processing layers to outputs and storage. Follow call chains across module boundaries to detect issues that only manifest through component interaction. When the scope is too large for a single pass, split work across parallel subagents (see Step 4 for partitioning strategy).

Report Format

The audit produces a self-contained file at the project root. The format determines the file extension and the template used in Step 5. HTML is the default because it enables inline SVG dataflow diagrams, severity badges, collapsible Intent Brief themes, and cross-reference anchors between findings — affordances that materially improve a long audit report and cannot be expressed in Markdown.

First, scan the user's launching message for an explicit format choice. Honor any of these: