code-auditlisted

# Code audit — Router Honest, actionable findings on a codebase: methodical questions across a multi-dimension framework (see the registry below), calibrated severity per finding, triageable output. Assistant-neutral — works wherever this skill folder is loaded. ## When to invoke - "audit my code/project/codebase", "tech audit", "tech DD" - "security review", "security audit", "vuln scan" - "is this ready to ship?", "release check", "pre-release" - an explicit invocation of this skill (a `/code-audit` slash command, an `@code-audit` mention, or however your assistant invokes skills) Routine "review this PR/file" is better served by a lightweight diff- review tool if your assistant ships one. The `quick` cut here exists for explicit narrow scans. ## Step 1 — pick the cut If intent is clear, pick directly; ask only when genuinely ambiguous. | Cut | When | Loads | |---|---|---| | **quick** | explicit narrow scan of a file/PR/diff | `cuts/quick.md` + languages | | **security** | "security review", "OWASP" | `cuts/security.md` (D4+D5+threat-models) | | **release** | "ready to ship?", release tag | `cuts/release.md` | | **deep** | "deep audit on X", named dimensions | `cuts/deep.md` + those dimensions | | **full** | "full audit", "tech DD" | `cuts/full.md` + every dimension | No-args fallback: **quick** on a narrow open target, **full** on a repo root. ## Step 2 — detect the stack Markers are searched recursively (depth ≤3, dependency dirs pruned — see `routing/detect-s