{{project_slug}}-audit

{{project_display_name}} Audit

Read-only audit of the project defined in this repo. Produces a scored, evidence-based report and refreshes docs/PRODUCTION-READINESS-AUDIT.md.

This skill never modifies source, never bumps versions, never tags, never pushes, never deploys, never writes to external services. It only reads, runs the repo's own gates, and writes the audit doc. Fixing anything it finds is deferred to normal ticketed work or /{{project_slug}}-release.

When to Activate

• User asks: "is the project production-ready", "is it ready to ship", "audit {{project_slug}}", "score the project".
• User asks specifically about security posture, compliance, or overall score.
• User invokes /{{project_slug}}-audit.

Preconditions

Run from the repo root (package.json with "name": "{{project_slug}}"). If not, stop and tell the user to cd into the repo.

Inputs

Optional argument: --quick — skip the long/costly gates (full test suite, production build, any gate that hits a paid external API). Rely instead on the most recent CI run (gh run list --workflow ci.yml) and the newest local artifacts, and mark any domain scored from stale data as such.

Default: full audit.

Workflow

Step 1 — Snapshot the repo state

Run in parallel via Bash:

• git status --porcelain — a dirty tree is auditable but must be reported.
• git log --oneline -15 — recent cadence.
• git tag --sort=-creatordate | head -5 — no tags yet is expected pre-launch; say so explicitly.
• jq '{name, version, private, packageManager, scripts}' package.json — version, scripts, package manager.
• ls .github/workflows/ — workflow surface.
• ls docs/ — structural map.