audit

audit is a command for Claude Code from CharlesWiltgen/Axiom. It costs 11 tokens per session (2,992 once invoked), scanned A, original, MIT.

A command that examines an iOS project and selects or suggests specialized audits for areas such as builds, memory, data storage, energy use, and Swift code.

In plain words
What is it for?
Use it to choose audits for build speed, JSON handling, Core Data, memory leaks, deprecated APIs, Swift performance, code simplification, or test failures.
Why use it?
It helps direct a review to relevant problems instead of requiring developers to know which audit to run first.

Command for Claude Code

Written for Claude Code: disable-model-invocation in frontmatter. Also seen: mentions Claude Code.

Part of the axiom plugin — 27 skills, 17 commands, 42 agents, 5 hooks shipped together

About the project

Axiom is a toolkit of instructions, agents, commands, and development tools that give coding assistants specialized guidance for Apple operating-system development. It covers Swift, SwiftUI, interface design, data, concurrency, performance, networking, accessibility, logging, crash analysis, simulator testing, and profiling for iOS, iPadOS, watchOS, and tvOS. The catalogue contains 42 agents, 16 commands, and one plugin from this toolkit.

CharlesWiltgen/Axiom · 1,148 stars · on GitHub · charleswiltgen.github.io

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/charleswiltgen/axiom/audit
Clone the repo
git clone --depth 1 https://github.com/CharlesWiltgen/Axiom

Made for: Claude Code.

Or install axiom, the plugin that ships this one along with the rest of its 27 skills, 17 commands, 42 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for audit

README.md
[![agentmods](https://agentmods.dev/badge/commands/charleswiltgen/axiom/audit.svg)](https://agentmods.dev/commands/charleswiltgen/axiom/audit)
Your own site
<a href="https://agentmods.dev/commands/charleswiltgen/axiom/audit"><img src="https://agentmods.dev/badge/commands/charleswiltgen/axiom/audit.svg" alt="Measured on agentmods" height="20"></a>
Per session 11 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,992 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00011 $0.02992
Opus 5 $0.00005 $0.01496
Sonnet 5 $0.00002 $0.00598
Haiku 4.5 $0.00001 $0.00299

Measured 7d ago against content hash 827fc1f9dad8, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude-plugin/plugins/axiom/commands/audit.md · 215 lines

How it starts

The opening of the file, as written. The whole thing — 215 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are an iOS project auditor with access to specialized Axiom audit agents.

Your Task

If user specified an area → launch that specific audit agent If no area specified → analyze project and suggest relevant audits

Available Audits

Area Agent Detects
build build-optimizer Build time optimization opportunities
codable codable-auditor JSON serialization issues, Sendable violations
core-data core-data-auditor Thread safety, schema migrations, N+1 queries
energy energy-auditor Timer abuse, polling patterns, continuous location, animation leaks, background mode misuse
memory memory-auditor Retain cycles, leaks, Timer/observer patterns
modernization modernization-helper ObservableObject→@Observable, @StateObject→@State, deprecated APIs
swift-performance swift-performance-analyzer ARC issues, allocation patterns, generic specialization
swift-simplify swift-simplifier Behavior-preserving Swift simplifications — guard/optional cleanups, if/switch expressions, collection idioms, redundant boilerplate, dead availability guards
test-failures test-failure-analyzer Root-cause diagnosis for a failing or intermittent test — missing await confirmation, @MainActor gaps, shared suite state, missing .serialized
testing testing-auditor Flaky tests, slow tests, Swift Testing migration, test quality
concurrency concurrency-auditor Swift 6 data races, unsafe Task captures, actor isolation
liquid-glass liquid-glass-auditor iOS 26 adoption opportunities, toolbar improvements
resize resize-auditor Scene-lifecycle gaps, UIScreen.main, UIRequiresFullScreen, orientation-derived layout, fixed-canvas rendering, Mirroring input
swiftui-architecture swiftui-architecture-auditor Logic in view, MVVM/TCA patterns, boundary violations
swiftui-layout swiftui-layout-auditor GeometryReader misuse, deprecated screen APIs, hardcoded breakpoints, identity loss
swiftui-nav swiftui-nav-auditor NavigationStack issues, path management, deep linking
swiftui-performance swiftui-performance-analyzer Expensive body, formatters, whole-collection dependencies, missing lazy
textkit textkit-auditor TextKit issues, text rendering problems
ux-flow ux-flow-auditor Dead-end views, dismiss traps, buried CTAs, missing empty/loading/error states, accessibility dead ends
camera camera-auditor Deprecated camera APIs, missing interruption handlers, threading violations
foundation-models foundation-models-auditor Missing availability checks, main thread blocking, manual JSON parsing, guardrail handling
iap iap-auditor Missing transaction.finish(), weak receipt validation, missing restore, subscription status tracking, StoreKit test config gaps
networking networking-auditor Deprecated APIs (SCNetworkReachability), anti-patterns
database-schema database-schema-auditor Unsafe ALTER TABLE, DROP operations, missing idempotency, FK misuse, transaction safety
grdb-performance grdb-performance-auditor Raw SQL string interpolation, missing FK indexes, missing PRAGMA optimize, app-group WAL and suspension defense, INSERT OR REPLACE misused as upsert, observation on WITHOUT ROWID tables
icloud icloud-auditor iCloud integration issues, entitlements
storage storage-auditor File protection, storage strategies, data management
swiftdata swiftdata-auditor @Model struct, missing VersionedSchema models, relationship defaults, migration timing, N+1
accessibility accessibility-auditor VoiceOver labels, Dynamic Type, color contrast, WCAG compliance
spritekit spritekit-auditor Physics bitmask issues, draw call waste, node accumulation, action leaks
screenshots screenshot-validator Placeholder text, wrong dimensions, debug indicators, broken UI, competitor references
security security-privacy-scanner API keys in code, insecure storage, Privacy Manifests, ATS violations

Read the full file on GitHub · 215 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 215 lines · 11 tokens per session scan A 827fc1f9dad8

Subscribe to this mod's changes

audit is a command published in the GitHub repository CharlesWiltgen/Axiom (1,148 stars, last pushed today), licensed MIT. It adds 11 tokens to every session and 2,992 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.