code-auditor

Code Auditor Skill

Version 5.4.1 • Run code-audit --version to check your installed version. If versions differ, the CLI is authoritative — use code-audit <command> --help to see what your install actually supports.

You have the code-audit CLI available. It indexes every function, component, and struct in the codebase for semantic search and invariant enforcement. Use these commands instead of raw grep/find whenever possible.

The diagnostic frame

code-audit is a diagnostic instrument, not a judge. Three terms carry that:

• Reading — the human-facing name for one rule observation. The machine contract calls the same thing a violation (a "finding" in the JSON). The audit takes readings; it does not issue verdicts.
• Coverage panel — the report leads with what was measured (which rules fired, which were clean, which were not applicable), so a zero-reading run is not mistaken for a clean tree.
• Triage — severity is urgency, not permission. Three levels, and the axis is how fast a reading bites you: critical (already wrong in production, or will fail when this code runs), severe (a real defect that has not bitten yet), high (correct, but it does not match a convention). critical and severe are defects; high is a convention reading. Every reading blocks the edit gate by default. Queue order (critical → severe → high) is the order to act, not a license to skip.

When to use which command

code-audit search — find code by meaning, not just text

Use code-audit search <query> with its operator syntax instead of grep or rg. The full operator reference is in SKILL-SEARCH.md.

Key operators:

• calls:<fn> — every caller of a function (uses the call graph, not regex)
• dep:<module> — everything importing a module
• lang:<lang> complexity:>N — complex functions in a specific language
• exported: — public API surface
• file:<glob> — scope to matching file paths
• unused-imports — dead imports to clean up