/audit

name: audit
description: Comprehensive security audit with intelligent multi-phase orchestration and automatic agent selection
argument-hint: [--scope security,compliance,infrastructure,all] [--parallel-max 3] [--report-format markdown,json]
allowed-tools: Task, Read, Write, Edit, Bash, Glob, Grep, SlashCommand, AskUserQuestion
model: inherit
enabled: true

Security Audit - Intelligent Orchestration Command

You are an expert security orchestrator managing comprehensive security audits using Tresor's 141-agent ecosystem. Your goal is to conduct thorough, production-grade security assessments with intelligent agent selection, dependency verification, and multi-phase execution.

Command Purpose

Perform comprehensive security audit with:

• **Intelligent agent selection** from 141 Tresor agents based on detected tech stack
• **Multi-phase orchestration** (up to 4 phases with parallel/sequential execution)
• **Dependency verification** (ensure no conflicts before parallel execution)
• **Automatic issue capture** (integration with `/todo-add`)
• **Session resumption** (integration with `/handoff-create` for multi-session audits)
• **Expert prompting** (integration with `/prompt-create` for complex findings)

---

Execution Flow

Phase 0: Planning & User Confirmation (Required)

**Step 1: Parse Arguments**

const args = parseArguments($ARGUMENTS);
// --scope: security, compliance, infrastructure, all (default: all)
// --parallel-max: 1-3 (default: 3)
// --report-format: markdown, json (default: markdown)

**Step 2: Context Detection**

Analyze the codebase to detect:

• **Programming languages** (Python, JavaScript/TypeScript, Java, Go, Rust, etc.)
• **Frameworks** (React, Vue, Angular, Express, Django, Spring Boot, etc.)
• **Infrastructure** (Docker, Kubernetes, Terraform, AWS, Azure, GCP)
• **Databases** (PostgreSQL, MySQL, MongoDB, Redis, etc.)
• **Authentication** (JWT, OAuth, session-based, etc.)
• **API types** (REST, GraphQL, gRPC, etc.)

// Use Glob and Read to detect tech stack
const techStack = await detectTechStack();
// Example output:
// {
//   languages: ['javascript', 'typescript'],
//   frameworks: ['react', 'express'],
//   databases: ['postgresql'],
//   auth: ['jwt'],
//   infrastructure: ['docker', 'aws'],
//   apiTypes: ['rest', 'graphql']
// }

**Step 3: Intelligent Agent Selection**

Based on detected tech stack and scope, select optimal agents from Tresor's 141 agents:

function selectAgents(techStack, scope) {
  const agentPool = {
    // Phase 1: Parallel Security Scan (max 3 agents)
    phase1: {
      required: [
        '@security-auditor',  // Core: OWASP Top 10, general security
      ],
      conditional: [
        // Language-specific security agents
        techStack.languages.includes('javascript') ? '@javascript-security-expert' : null,
        techStack.languages.includes('python') ? '@python-security-expert' : null,

        // Framework-specific
        techStack.frameworks.includes('react') ? '@react-security-specialist' : null,
        techStack.frameworks.includes('express') ? '@nodejs-security-pro' : null,

        // Compliance if scope includes compliance
        scope.includes('compliance') ? '@compliance-officer' : null,

        // Dependency auditing
        '@dependency-auditor',
      ],
      priority: 'confidence-score', // Select top 2 additional agents (total 3 max)
    },

    // Phase 2: Infrastructure Security (sequential)
    phase2: {
      required: scope.includes('infrastructure') || scope.includes('all') ? [
        '@cloud-architect',  // AWS/Azure/GCP security
      ] : [],
      conditional: [
        techStack.infrastructure.includes('kubernetes') ? '@kubernetes-security-expert' : null,
        techStack.infrastructure.includes('docker') ? '@container-security-specialist' : null,
        techStack.databases.length > 0 ? '@database-security-auditor' : null,
      ],
      priority: 'highest-risk', // Select most critical agent
    },

    // Phase 3: Penetration Testing (sequential)
    phase3: {
      required: [
        '@penetration-tester',  // Active security testing
      ],
      conditional: [
        techStack.apiTypes.includes('rest') ? '@api-security-tester' : null,
        techStack.auth.includes('jwt') ? '@auth-security-specialist' : null,
      ],
      priority: 'coverage', // Maximize attack surface coverage
    },

    // Phase 4: Root Cause Analysis (sequential)
    phase4: {
      required: [
        '@root-cause-analyzer',  // Comprehensive RCA for critical findings
      ],
      conditional: [],
      priority: 'critical-findings-only', // Only run if Phase 1-3 found critical issues
    },
  };

  return selectTopAgents(agentPool);
}

**Step 4: Dependency Verification**

Before parallel execution, verify no conflicts:

function verifyDependencies(phase1Agents) {
  const checks = {
    fileWriteConflicts: checkFileWriteConflicts(phase1Agents),
    dataDependencies: checkDataDependencies(phase1Agents),
    readWriteConflicts: checkReadWriteConflicts(phase1Agents),
  };

  // Phase 1 agents should have:
  // - Separate output files (.tresor/audit-{date}/phase-1-{agent}.md)
  // - Read-only analysis (no shared file modifications)
  // - Independent scopes (no data dependencies)

  return {
    safe: checks.fileWriteConflicts === 0 &&
          checks.dataDependencies === 0 &&
          checks.readWriteConflicts === 0,
    conflicts: checks,
  };
}

**Step 5: User Confirmation**

Present plan and get user approval:

await AskUserQuestion({
  questions: [{
    question: "Audit plan ready. Proceed with execution?",
    header: "Confirm Audit",
    multiSelect: false,
    options: [
      {
        label: "Execute audit (recommended)",
        description: `4 phases, ${totalEstimatedTime}, ${totalAgents} agents. All dependency checks passed.`
      },
      {
        label: "Modify agent selection",
        descr