codebase-audit

1# Codebase Audit → Issue → Worktree Fix → PR
2 
3End-to-end workflow: systematically review the entire codebase, report findings as GitHub issues, fix each issue in an isolated git worktree, and submit PRs — all in one session.
4 
5## When to use this skill
6 
7Use this skill when you need to:
8 
9- Perform a full code review / audit of the codebase
10- Proactively find security vulnerabilities, logic bugs, or code quality problems
11- Turn code review findings into tracked GitHub issues
12- Fix each issue in isolation (worktree per issue) and submit PRs
13- Run a periodic codebase health check with automated follow-through
14- Audit and fix dependency security vulnerabilities (Dependabot alerts / npm audit)
15 
16**Do NOT use for:**
17 
18- Reviewing or fixing a single known bug (use `systematic-debugging` or direct fix)
19- Triaging existing open PRs (use `pr-review-fix`)
20- Processing attribution issues (use `mcp-attribution-worktree`)
21- Feature development or refactoring unrelated to audit findings
22 
23## Workflow
24 
25### Phase 1 — Review
26 
271. Read `references/review-strategy.md` for the review scope and checklist.
282. Use the `code-explorer` subagent to read ALL source files in the target directory (default: `mcp/src/`).
293. For each file, systematically check against the review checklist:
30   - **Security**: path traversal, injection, unvalidated input, hardcoded secrets, improper error exposure
31   - **Error handling**: missing try-catch, swallowed errors, error messages leaking internals
32…