Check	Threshold
Bundle JS	> 100kb
Unused dependencies	Any
console.log in code	Any

Audit Sequence

npx astro check           # TypeScript
npm audit --audit-level=high  # Security
npx depcheck              # Unused deps
npx astro build           # Build
# Then: Lighthouse, Browser tests, Form tests

Run scripts/audit.sh for automated checks.

Browser Compatibility (Required)

Platform	Test
Desktop	Chrome, Firefox, Safari, Edge
iOS	Safari, Chrome (SE, 14, 15 Pro Max)
Android	Chrome, Samsung Internet

See references/browser-tests.md.

Form Testing (10 Scenarios)

#	Test
1	Valid submission → success + email
2	Empty fields → validation errors
3	Invalid email → error
4	Invalid phone → error
5	XSS `<script>` → sanitized
6	SQL injection → no error
7	Honeypot filled → silent reject
8	No Turnstile → reject
9	5x rapid submit → rate limited
10	Mobile keyboard → works

See references/form-tests.md.

Credential Scan (BLOCK)

grep -rn "sk_live\|pk_live\|api_key\|secret" src/
git ls-files | grep "\.env$"

ANY match = BLOCK RELEASE

See references/credential-scan.md.

Skill Compliance

Verify against all active skills:

astro-forms (Turnstile, honeypot, Zod)
astro-security (headers, CSP, rate limit)
astro-ux (sections, CTAs, mobile bar)
Project SPEC.md

See references/skill-compliance.md.

Definition of Done

BLOCK (must fix):

Quality:

Bundle < 100kb JS
No console.logs
Skill compliance verified
Mobile tested real device

Automated Script

#!/bin/bash
# scripts/audit.sh
set -e

echo "🔍 Audit..."
npx astro check
npm audit --audit-level=high

# Credential scan
if grep -rn "sk_live\|pk_live" src/ 2>/dev/null; then
  echo "❌ BLOCK: Credentials found"; exit 1
fi
if git ls-files | grep -qE "^\.env$"; then
  echo "❌ BLOCK: .env in git"; exit 1
fi

npx astro build

JS=$(find dist -name "*.js" -exec cat {} + 2>/dev/null | wc -c)
[ $JS -gt 102400 ] && echo "⚠️ JS > 100kb"

echo "✅ Auto-audit done. Run browser + form tests manually."

References

browser-tests.md — Cross-browser matrix
form-tests.md — 10-scenario form testing
credential-scan.md — Secret patterns
skill-compliance.md — Skill verification
seo-checks.md — SEO audit
performance.md — Core Web Vitals
a11y-checks.md — Accessibility

astro-audit

Astro Audit Skill

Core Rules (BLOCK)

Core Rules (WARN)