code-audit-tools Plugin

Audit a codebase the way Legion Code Inc. does: foundation health, duplication and dead code, framework-deep security, quality, and a remediation plan, delivered as a branded brief.

Renders the Audit My Code brief, one self-contained Field Guide styled HTML file per run, from the run workspace. Use as the final step of /audit-my-code, to re-render after a Drone fixes its output, or to rebrand the brief. Do NOT use to run or re-score any audit dimension, or to write into the aud

Read-only code bloat audit for the bloat dimension of /audit-my-code. Measures copy-pasted code (jscpd), unused files, exports and dependencies (knip or language tools, spot-checked by hand), line counts (cloc or scc), and giant files, functions and closures (lizard), then writes 01-bloat findings,

Review software and agency engagements from supplied contracts, invoices, communications and delivery evidence. Produce cited evidence drafts for human or counsel review. Use for an authorized forensic engagement, not routine code review or legal advice.

Foundation (health) audit of a code repository for /audit-my-code. Checks Wasp Nest setup, AI agent readiness, CI, tests, lint, lockfiles, secrets hygiene and governance; writes findings, metrics and notes to the run workspace. Do NOT use to fix the repo.

Empirical security audit of Lovable-built Supabase apps: row-level-security denial verification, role-differential visibility probes, Edge Function gating checks, auth-posture readout, client-bundle key and endpoint forensics, findings triage against an operator risk taxonomy, and grounded reporting

Deep, evidence-backed Next.js security audit (versions 13 to 16, App and Pages Router) for an /audit-my-code run. Use when intake.json lists the nextjs stack, or when asked whether a Next.js app's version, middleware or proxy auth, Server Actions, Route Handlers, caching, or next.config are safe. Wr

Deep, read-only security audit of non-React, non-Next.js, non-SvelteKit code (Node servers, Python, Go, Rust, Rails, PHP, Spring, .NET) plus secrets, dependencies, static analysis, and CI/CD and infrastructure, writing SEC-POLY findings in the Audit My Code contract shape. Use when an /audit-my-code

Deep, evidence-backed security audit of React 18 and 19 code for /audit-my-code. Use when stack routing sends react (or nextjs, for client patterns), or when asked to check XSS sinks, SSR injection, RSC runtime CVEs such as React2Shell, Server Functions, bundle secrets, client-side trust, or AI-buil

Turns Mario Audit findings into a remediation roadmap (Now, Next, Later), plan.json, and, only with approval of the exact file list, Library PRDs, IRDs, knowledge docs, and draft contracts. Run after the four audit dimensions. Do NOT use to implement fixes, scaffold library/, or accept contracts.

Deep, evidence-backed, read-only security audit of Svelte 4/5 and SvelteKit 2 apps (and plain Svelte + Vite SPAs) on any stack, for an /audit-my-code run. Use when intake.json lists the svelte or sveltekit stack, or when asked whether a SvelteKit app's versions, load functions, form actions, +server

Swarm-audit scout, observer, and assembler. Use when the user asks for a swarm audit, a state of the union, an audit of every branch local and remote, where the team screwed up, or an ultracode fleet on a repository. Scouts and briefs the fleet, runs each 10-minute check-in (fails and stalls, kill a

Orchestrates multi-tier codebase audits by dispatching specialized drones to analyze security, bloat, and quality, delivering a comprehensive brief.

Renders a self-contained HTML audit brief from a workspace into a Field Guide styled report suitable for mobile viewing or PDF export.

Performs a read-only audit of codebases to measure duplication, unused code, and structural bloat using various analysis tools.

Performs forensic reviews of software vendor engagements by analyzing contracts, invoices, communications, and git logs to produce cited evidence drafts.

Performs a read-only health audit of a repository to assess readiness for human and AI agent collaboration.

Audit Lovable-built Supabase applications by analyzing RLS posture, edge function gating, authentication configurations, and client bundle exposure.

Performs deep security audits for Next.js applications by checking for version vulnerabilities, auth boundary gaps, and data exposure risks.

Performs deep security audits across multiple backend ecosystems including Node.js, Python, Go, Rust, and more to identify vulnerabilities and secrets.

Audits React 18/19 applications for security vulnerabilities including XSS, secrets exposure, and RSC server function risks.

Converts audit findings into actionable remediation roadmaps, work packages, and technical documentation like PRDs and IRDs.

Audits codebases for foundation health, duplication, dead code, security vulnerabilities, and quality to provide a remediation plan.

Performs a read-only security audit of Svelte and SvelteKit applications to identify vulnerabilities like XSS, CSRF, and data leaks.

Performs a comprehensive repository audit using a multi-agent swarm to investigate branches, code, documentation, and infrastructure.