code-auditing

Code Auditing Skill

Comprehensive methodology for systematic code quality audits.

When to Use

• Comprehensive code quality audits
• Security vulnerability assessments
• Technical debt identification
• Pre-release code reviews
• Best practices verification
• Library and dependency audits

Audit Phases

Phase 0: Pre-Analysis Setup

1. Check for project configuration files (package.json, tsconfig.json, etc.)
2. Identify tech stack and main libraries
3. Check for linting/formatting configs
4. Run existing linting/testing commands as baseline
5. Load documentation for identified core libraries

Phase 1: Discovery

1. Find all code files by type
2. Create tracking list for each file
3. Group files by module/feature for contextual analysis

Phase 2: File-by-File Analysis

For each file, analyze for:

• Dead code (unused functions, variables, imports)
• Code smells and anti-patterns
• Custom implementations that could use established libraries
• Security vulnerabilities
• Performance issues
• Outdated patterns or deprecated APIs
• Missing error handling
• Overly complex functions
• Duplicate code

Phase 3: Best Practices Verification

For every library and framework:

1. Retrieve official documentation
2. Compare implementation against official patterns
3. Identify deviations from recommendations
4. Note outdated usage patterns
5. Flag discouraged anti-patterns

Phase 4: Pattern Detection

Look for recurring issues:

• Common anti-patterns across files
• Duplicated logic that could be abstracted
• Inconsistent coding styles
• Missing error handling patterns

Phase 5: Library Recommendations

For custom implementations:

1. Check if current libraries provide the functionality
2. Search for mature ecosystem packages
3. Verify library health (commits, issues, activity)
4. Check compatibility with project setup

Phase 6: Comprehensive Report

Generate detailed report with:

• Executive summary
• Critical issues requiring immediate attention
• File-by-file findings
• Prioritized action plan
• Effort estimates
• Library recommendations

Issue Priority Levels

• Critical - Security vulnerabilities, broken functionality
• High Priority - Performance bottlenecks, unmaintainable code
• Medium Priority - Code quality, best practices deviations
• Low Priority - Style, minor improvements
• Quick Wins - Less than 30 minutes to fix

Analysis Categories

Security

• Hardcoded secrets
• SQL injection risks
• XSS vulnerabilities
• Missing input validation
• Exposed sensitive data

Performance

• Inefficient algorithms
• Blocking operations
• Memory leaks
• Missing caching opportunities
• N+1 query patterns

TypeScript/Type Safety

• Missing type annotations
• Use of any type
• Custom types duplicating official types
• Missing @types packages

Async/Promise Issues

• Missing await keywords
• Unhandled promise rejections
• Callback hell

Dead Code

• Unused imports and exports
• Unused functions, classes, and methods
• Unused variables and types
• Unreachable code blocks
• Unused files (not imported anywhere)
• Unused dependencies

Tools:

• JavaScript/TypeScript: npx knip --reporter json
• Python: deadcode . --dry

Important: Always verify tool findings before reporting. Check for:

• Dynamic imports (import(variable))
• Framework patterns (React components, decorators)
• Re-exports for public API
• Entry points (CLI scripts, serverless handlers)

Resources

See the reference documents for complete methodologies:

• references/audit-methodology.md - Full 6-phase audit process with detailed checklists
• references/dead-code-methodology.md - Dead code detection tools, verification, and cleanup workflows

Quick Reference

Before Starting

• Read project configuration files
• Identify tech stack and libraries
• Run existing linters as baseline
• Create file tracking list

During Audit

• Mark files as in-progress
• Analyze each category systematically
• Note specific line numbers
• Document before/after examples
• Mark files as completed

After Audit

• Categorize all findings by priority
• Generate comprehensive report
• Save report to project root
• Provide brief console summary