# 04 Audit

Audit a codebase read-only across seven quality pillars into one ranked report.

- Repository: https://github.com/ai-driven-dev/framework (542 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add ai-driven-dev/framework --skill 04-audit -g -a claude-code -y`
Codex: `npx skills add ai-driven-dev/framework --skill 04-audit -g -a codex -y`
Cursor: `npx skills add ai-driven-dev/framework --skill 04-audit -g -a cursor -y`
Gemini CLI: `npx skills add ai-driven-dev/framework --skill 04-audit -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add ai-driven-dev/framework`

## Description

Audit a codebase read-only across seven quality pillars into one ranked report. Use when the user wants to assess, health-check, or audit a codebase or one pillar. Not for fixing findings, reviewing a change, or checking a feature works.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Skill: audit

Diagnose a codebase against quality pillars and emit one ranked findings report. Read-only: it identifies and ranks problems, never changes code.

## Actions

| #   | Action         | Pillar       | Lens                                                                 |
| --- | -------------- | ------------ | -------------------------------------------------------------------- |
| 01  | `code-quality` | code-quality | Clean code (naming, SOLID, DRY, readability, smells) and tech debt (dead code, complexity, file/function size, error handling) |
| 02  | `architecture` | architecture | Conformance to C4 / ADRs, coupling, boundaries, layering             |
| 03  | `security`     | security     | OWASP risks, authz, input validation, secrets in code                |
| 04  | `dependencies` | dependencies | CVEs, licenses, outdated and unused deps, supply chain               |
| 05  | `performance`  | performance  | N+1 queries, hot paths, bundle size, heavy operations                |
| 06  | `tests`        | tests        | Critical-path coverage, flakiness, test pyramid balance              |
| 07  | `ui`           | ui           | Loading/error/empty states, visual hierarchy, design-system drift, responsive, a11y |

Run the one pillar named, or offer all seven when the request is unscoped.
Before running an action, read its file in `actions/`, not only the table or assets.

## Transversal rules

The rest: https://github.com/ai-driven-dev/framework/blob/HEAD/plugins/aidd-dev/skills/04-audit/SKILL.md