/audit

description: Run the full 360 pre-ship audit and write a report
argument-hint: [path (optional, defaults to project root)]
allowed-tools: Read, Grep, Glob, Bash, Task, Write

Run a comprehensive **Preflight Security Audit** on `$1` (default: the current project root). Follow the methodology in the `preflight-security-audit` skill — read `${CLAUDE_PLUGIN_ROOT}/skills/preflight-security-audit/SKILL.md` and the reference files it points to.

Execute these steps:

1. **Scope & detect stack.** Read `package.json`/lockfiles/config and skim the tree to identify languages, frameworks, and services (Next.js, Supabase, Stripe, AI SDKs, email providers, etc.). State the scope and detected stack up front. From the stack, decide which **stack-conditional** passes apply — serverless/edge (Vercel/Netlify/Lambda/Workers), GraphQL/WebSocket/SSE, Docker (Dockerfile/compose), and JWTs — and skip the ones whose markers are absent (mark them N/A).

2. **Run all six tracks.** Always run every track; **stack-conditional passes run only when their marker was detected in step 1** — skip and mark N/A otherwise (keeps scans fast).

• Prefer to dispatch the five auditor agents in parallel with the Task tool:

`code-core-auditor`, `web-security-auditor`, `ai-security-auditor`, `privacy-compliance-auditor`, `launch-readiness-auditor`. Give each the scope path and tell it to read its matching reference file.

• If subagents are unavailable, run the passes inline by reading each reference

file (`01`–`05`) and sweeping the code yourself.

3. **Collect** every raw finding with: `file:line`, track, category, description, exploit/failure path, suggested fix, proposed severity.

4. **Verify (Track 6).** Run the combined findings through the `finding-verifier` agent (or `references/06-verification.md` inline). Reject anything unprovable, merge duplicates, and recalibrate severity per the rubric.

5. **Write the report** to `AUDIT-<YYYY-MM-DD>.md` in the project root using the template in SKILL.md. Include the summary counts, the **0–100 security score** (per `references/06-verification.md`), and the ship recommendation (BLOCK / FIX-FIRST / GO-WITH-FOLLOWUPS / GO).

6. **Report back in chat**: the counts, the **security score**, the ship recommendation, and the top 3 findings. For every Critical and High finding, show the proposed fix as a concrete diff and ask which the user wants applied. **Do not edit any code in this command** — applying fixes is done by `/audit-fix` after approval.

Be evidence-driven: never report a finding you cannot tie to a concrete line and a real exploit or failure path. A false alarm is as harmful as a miss.