# Audit My App

Sweep a whole running web app for what is broken, without writing a script or knowing...

- Repository: https://github.com/reticlehq/reticle (1299 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add reticlehq/reticle --skill audit-my-app -g -a claude-code -y`
Codex: `npx skills add reticlehq/reticle --skill audit-my-app -g -a codex -y`
Cursor: `npx skills add reticlehq/reticle --skill audit-my-app -g -a cursor -y`
Gemini CLI: `npx skills add reticlehq/reticle --skill audit-my-app -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add reticlehq/reticle`

## Description

Sweep a whole running web app for what is broken, without writing a script or knowing the codebase. Clicks every reachable control and reports dead buttons, console errors, failed requests, and places where the API and the screen disagree. Use on an unfamiliar codebase, before a release, after a big merge or dependency bump, when the user asks for a smoke test or a health check, or when someone says "just check everything still works".

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Sweep the whole app and report what is broken

You do not need to understand the codebase to check it. **Reticle** drives every reachable control in the running app and reports the anomalies. Not set up? Follow the [`reticle`](https://github.com/reticlehq/reticle/blob/main/skills/reticle/SKILL.md) skill: it installs Reticle, asks the user before `init` changes the app's files, and proves one flow.

## 1. Ask the app what it can do

```
reticle_run({ tool: "reticle_capabilities", args: { sessionId } })
```

About 1 KB, and it is the app describing its own testable surface: every registered testid, every domain signal, the stores, and the saved flows with their steps. That beats snapshotting the DOM and inferring intent from element names, and it is the cheapest orientation available.

## 2. Click everything

```
reticle_run({ tool: "reticle_verify", sessionId, args: { action: "crawl", maxSteps: 25 } })
```

```json
{
  "interactiveFound": 3,
  "stepsRun": 3,
  "anomalies": [],
  "counts": { "consoleErrors": 0, "failedRequests": 0, "deadControls": 0, "contradictions": 0 },
  "visited": ["- textbox \"Email\"", "- button \"Sign in\""],
  "truncated": false
}
```

**`deadControls` and `contradictions` are the two counts that mean a real problem.** Console errors and failed requests are worth reading but a busy app produces both innocently. A dead control is a button wired to nothing; a contradiction is a channel disagreeing with what the screen showed.

It clicks **everything**, so point it at a dev environment. `maxSteps` bounds it and defaults to 25. Want a non-destructive pass first: what is reachable, without touching it? `reticle_run({ tool: "reticle_explore", sessionId })`.

Do not hand-roll this sweep. The obvious version (click each control, assert no console error) **passes on exactly the bug you are sweeping for**, because a dead button throws nothing.

## 3. Compare what the API said against what rendered

The rest: https://github.com/reticlehq/reticle/blob/HEAD/skills/audit-my-app/SKILL.md