/audit
Run the full 360 pre-ship audit and write a report
$ npx -y skills add akirtok/preflight-security-audit --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/audit
Context preview
What this command does when you run it.
Run the full 360 pre-ship audit and write a report
Command definition
audit.mddescription: Run the full 360 pre-ship audit and write a report
argument-hint: [path (optional, defaults to project root)]
allowed-tools: Read, Grep, Glob, Bash, Task, Write
Run a comprehensive **Preflight Security Audit** on `$1` (default: the current project root). Follow the methodology in the `preflight-security-audit` skill — read `${CLAUDE_PLUGIN_ROOT}/skills/preflight-security-audit/SKILL.md` and the reference files it points to.
Execute these steps:
1. **Scope & detect stack.** Read `package.json`/lockfiles/config and skim the tree to identify languages, frameworks, and services (Next.js, Supabase, Stripe, AI SDKs, email providers, etc.). State the scope and detected stack up front. From the stack, decide which **stack-conditional** passes apply — serverless/edge (Vercel/Netlify/Lambda/Workers), GraphQL/WebSocket/SSE, Docker (Dockerfile/compose), and JWTs — and skip the ones whose markers are absent (mark them N/A).
2. **Run all six tracks.** Always run every track; **stack-conditional passes run only when their marker was detected in step 1** — skip and mark N/A otherwise (keeps scans fast).
- Prefer to dispatch the five auditor agents in parallel with the Task tool:
`code-core-auditor`, `web-security-auditor`, `ai-security-auditor`, `privacy-compliance-auditor`, `launch-readiness-auditor`. Give each the scope path and tell it to read its matching reference file.
- If subagents are unavailable, run the passes inline by reading each reference
file (`01`–`05`) and sweeping the code yourself.
3. **Collect** every raw finding with: `file:line`, track, category, description, exploit/failure path, suggested fix, proposed severity.
4. **Verify (Track 6).** Run the combined findings through the `finding-verifier` agent (or `references/06-verification.md` inline). Reject anything unprovable, merge duplicates, and recalibrate severity per the rubric.
5. **Write the report** to `AUDIT-<YYYY-MM-DD>.md` in the project root using the template in SKILL.md. Include the summary counts, the **0–100 security score** (per `references/06-verification.md`), and the ship recommendation (BLOCK / FIX-FIRST / GO-WITH-FOLLOWUPS / GO).
6. **Report back in chat**: the counts, the **security score**, the ship recommendation, and the top 3 findings. For every Critical and High finding, show the proposed fix as a concrete diff and ask which the user wants applied. **Do not edit any code in this command** — applying fixes is done by `/audit-fix` after approval.
Be evidence-driven: never report a finding you cannot tie to a concrete line and a real exploit or failure path. A false alarm is as harmful as a miss.
Read more
description: Run the full 360 pre-ship audit and write a report argument-hint: [path (optional, defaults to project root)] allowed-tools: Read, Grep, Glob, Bash, Task, Write
Run a comprehensive **Preflight Security Audit** on `$1` (default: the current project root). Follow the methodology in the `preflight-security-audit` skill — read `${CLAUDE_PLUGIN_ROOT}/skills/preflight-security-audit/SKILL.md` and the reference files it points to.
Execute these steps:
1. **Scope & detect stack.** Read `package.json`/lockfiles/config and skim the tree to identify languages, frameworks, and services (Next.js, Supabase, Stripe, AI SDKs, email providers, etc.). State the scope and detected stack up front. From the stack, decide which **stack-conditional** passes apply — serverless/edge (Vercel/Netlify/Lambda/Workers), GraphQL/WebSocket/SSE, Docker (Dockerfile/compose), and JWTs — and skip the ones whose markers are absent (mark them N/A).
2. **Run all six tracks.** Always run every track; **stack-conditional passes run only when their marker was detected in step 1** — skip and mark N/A otherwise (keeps scans fast).
- Prefer to dispatch the five auditor agents in parallel with the Task tool:
`code-core-auditor`, `web-security-auditor`, `ai-security-auditor`, `privacy-compliance-auditor`, `launch-readiness-auditor`. Give each the scope path and tell it to read its matching reference file.
- If subagents are unavailable, run the passes inline by reading each reference
file (`01`–`05`) and sweeping the code yourself.
3. **Collect** every raw finding with: `file:line`, track, category, description, exploit/failure path, suggested fix, proposed severity.
4. **Verify (Track 6).** Run the combined findings through the `finding-verifier` agent (or `references/06-verification.md` inline). Reject anything unprovable, merge duplicates, and recalibrate severity per the rubric.
5. **Write the report** to `AUDIT-<YYYY-MM-DD>.md` in the project root using the template in SKILL.md. Include the summary counts, the **0–100 security score** (per `references/06-verification.md`), and the ship recommendation (BLOCK / FIX-FIRST / GO-WITH-FOLLOWUPS / GO).
6. **Report back in chat**: the counts, the **security score**, the ship recommendation, and the top 3 findings. For every Critical and High finding, show the proposed fix as a concrete diff and ask which the user wants applied. **Do not edit any code in this command** — applying fixes is done by `/audit-fix` after approval.
Be evidence-driven: never report a finding you cannot tie to a concrete line and a real exploit or failure path. A false alarm is as harmful as a miss.
You vibe-coded an app. Everything works. But is it safe to ship? A one-command, 61-check pre-ship audit for AI-coded apps — security, reliability, performance, AI/LLM, privacy, and launch readiness — that finds the vulnerabilities, scores your app 0–100, and
Repo: akirtok/preflight-security-audit