code-auditor

Code Auditor Skill

Version 3.4.8 • Run code-audit --version to check your installed version. If versions differ, the CLI is authoritative — use code-audit <command> --help to see what your install actually supports.

You have the code-audit CLI available. It indexes every function, component, and struct in the codebase for semantic search and invariant enforcement. Use these commands instead of raw grep/find whenever possible.

When to use which command

code-audit search — find code by meaning, not just text

Use code-audit search <query> with its operator syntax instead of grep or rg. The full operator reference is in SKILL-SEARCH.md.

Key operators:

• calls:<fn> — every caller of a function (uses the call graph, not regex)
• dep:<module> — everything importing a module
• lang:<lang> complexity:>N — complex functions in a specific language
• exported: — public API surface
• file:<glob> — scope to matching file paths
• unused-imports — dead imports to clean up

Free-text terms search function names, signatures, JSDoc, and bodies via FTS5. This is almost always faster and more accurate than grepping.

code-audit search "calls:validateUser lang:typescript complexity:>5" --limit 20 --json
code-audit search --definition "UserService.createUser"   # look up a specific symbol
code-audit search "dep:express exported:" --language go   # Go functions that import express and are exported

code-audit audit — run analysis before claiming work is done

Run an audit before declaring a task complete:

code-audit audit --path .                           # Full audit
code-audit changed --json --fail-on critical         # Diff-scoped audit (hook contract)

Use code-audit changed after edits to confirm you haven't introduced violations. If the hook is active it already runs code-audit changed --fail-on critical automatically on Write/Edit — pay attention to its output.

Expected output: JSON violation list (with --json) or colored terminal summary. Non-zero exit code means violations at or above --fail-on severity were found.