audit

# Audit Project-wide health audit. Fans out to all analysis skills, evaluates findings, and writes `.turbo/audit.md` and `.turbo/audit.html`. Analysis-only — does not apply fixes. ## Task Tracking At the start, use `TaskCreate` to create a task for each phase: 1. Scope and partition 2. Threat model 3. Run analysis skills 4. Run `/evaluate-findings` skill 5. Generate markdown report 6. Generate HTML report ## Step 1: Scope and Partition If `$ARGUMENTS` specifies paths, use those directly (skip the question). Otherwise, use `AskUserQuestion` to confirm scope: - **All source files** — audit everything - **Specific paths** — user provides directories or file patterns - **Critical paths** — heuristically identify high-risk areas (entry points, auth, data handling, payment processing) Once scope is determined: 1. Glob for source files in the selected scope. Exclude generated and vendored directories (`node_modules/`, `dist/`, `build/`, `vendor/`, `__pycache__/`, `.build/`, `DerivedData/`, `target/`, `.tox/`, and others appropriate to the project). 2. Partition files by top-level source directory. Cap at 10 partitions. If more than 10 top-level directories exist, group related directories or use `AskUserQuestion` to narrow scope. If a single directory contains 50+ files, sub-partition it by its immediate subdirectories. ## Step 2: Threat Model Check whether `.turbo/threat-model.md` exists. When it exists, collect each surface's cited paths from **Entry points and sinks**...