Audit Swarm

How It Works

1. Audit a project: Full, weekly diff-aware, or all-projects code audit
2. Preflight + init output: List changed/source files · seed code-audits/{project}/MASTER-SUMMARY.md
3. Dispatch 4 domain agents
4. Synthesize findings: Merge domain tables · sort P0→P1→P2 · update summary counts
5. MASTER-SUMMARY + tickets: Findings with file:line · P0/P1 tickets created — surfaces, never auto-fixes

Invocation Triggers

Use Cases

• Weekly automated code audit across all your projects
• Pre-release security and quality gate
• Onboard a new codebase with a structured review

The Problem

Code rot is quiet. The N+1 query, the god module, the business logic bleeding into the view layer, the critical path with zero tests — none of them throw errors, so none of them get looked at until one becomes a 2am incident. A single reviewer sees one lens at a time and forgets the other three. You end up with a vague impression that the codebase is fine, and no file:line record anyone can act on.

What It Does

1. 1
   Preflight the scope

   List changed files since the last audit for weekly diff-aware mode (git diff HEAD~7), or enumerate all source files for a full audit. Weekly mode is the default — small audits beat large ones.

2. 2
   Initialize the output

   Create code-audits/<project>/ and seed MASTER-SUMMARY.md with a priority summary table and an empty findings table. Every finding will land here with a file:line reference, never a vague note.

3. 3
   Dispatch four domain agents in parallel

   Security, Architecture, Performance, and Testing agents (all sonnet, read-heavy) launch in a single message. Sequential dispatch defeats the entire purpose — they run simultaneously, each writing to its own domain file.

4. 4
   Audit each domain independently

   Security hunts injection, auth flaws, and hardcoded secrets. Architecture flags god objects, circular deps, and leaked business logic. Performance catches N+1s and missing pagination. Testing finds uncovered critical paths and mock-only tests. P0s get fixed; P1/P2 documented.

5. 5
   Synthesize the master summary

   Merge every domain's findings table, sort P0 to P2, and update the summary counts. P0 counts in the summary must match the actual P0 rows — a mismatch means aggregation was skipped. Architecture being clean never implies tests are.

6. 6
   Ticket the P0s and P1s

   Create a kanban card for each P0 and P1 finding so the work has a lifecycle, not just a note in a file. The findings become actionable, traceable, and ready for audit-swarm-resolve.

What You Get / What It Doesn't Do

Tips

Get the Skill

Commonly Used With