code-audit-tools

Plugin code-audit-tools from marketplace wasp-nest in legioncodeinc/vibe-coding-tools. Commands read from the repo's manifest — 29 days ago.

Skills (13)

• audit-my-code-stinger

  Orchestrates /audit-my-code. Five tiers (foundation, vibe, basic, full, mario) of codebase audits, dispatched to paired Drones and delivered as a Legion Code Inc. brief.

• code-audit-brief-stinger

  Render the Audit My Code brief, one self-contained Field Guide styled HTML file per run, from the workspace only. Escapes repo text, merges duplicates, prints cleanly to PDF.

• code-bloat-stinger

  Read-only bloat audit of any repo. jscpd duplication, knip or language dead-code tools with a spot-check, cloc size, function and closure structure, split plans, banded verdict.

• code-forensics-stinger

  Review software vendor engagements using contracts, invoices, messages and delivery records. Produce cited evidence drafts for human or counsel review. Read README.md for the guide map.

• code-foundation-stinger

  Read-only repo health audit: Wasp Nest setup, agent readiness, CI, tests, lint, lockfiles, secrets, governance. Writes contract-shaped foundation findings and measures. Never edits the repo.

• lovable-audit-stinger

  Audit Lovable-built Supabase apps: RLS denials, role-differential reads, function gating, auth posture, bundle-forensics key/endpoint extraction, findings triage, reporting.

• nextjs-security-stinger

  Deep Next.js security audit (13 to 16, App and Pages Router). Version advisories, proxy and middleware auth, Server Actions, Route Handlers, data exposure, caching, config. Read-only.

• polyglot-security-stinger

  Deep security audit for Node servers, Python, Go, Rust, Rails, PHP, Spring, and .NET, plus secrets, dependencies, SAST, and CI. Read-only, writes Audit My Code findings.

• react-security-stinger

  Review React 18/19 security, including Next.js clients. Covers XSS, secrets and client trust. Delegate Next.js server surfaces to nextjs-security-stinger. Read-only.

• remediation-planning-stinger

  Plan fixes from audit findings. Clusters findings into work packages, orders Now, Next, Later, and with approval writes Library PRDs, IRDs, knowledge docs, and draft contracts.

• source-command-audit-my-code

  Audit a codebase the way Legion Code Inc. does: foundation health, duplication and dead code, framework-deep security, quality, and a remediation plan, delivered as a branded brief.

• sveltekit-security-stinger

  Evidence-backed, read-only security audit of Svelte 4/5 and SvelteKit 2 apps, any stack. Versions vs advisories, load leaks, actions, remote functions, hooks, XSS, CSRF, adapters.

• swarm-audit-stinger

  Swarm audit of a repository: Workflow fleet of single-lens Sonnet investigators, adversarial verification, Opus interpreters and critic, 10-minute check-ins, kill and respawn, nothing unreviewed.

Slash commands (1)

• /code-audit-tools:audit-my-code

  Audit a codebase the way Legion Code Inc. does: foundation health, duplication and dead code, framework-deep security, quality, and a remediation plan, delivered as a branded brief.

Subagents (11)

• code-audit-brief-wasp-drone

  Renders the Audit My Code brief, one self-contained Field Guide styled HTML file per run, from the run workspace. Use as the final step of /audit-my-code, to re-render after a Drone fixes its output, or to rebrand the brief. Do NOT use to run or re-score any audit dimension, or to write into the aud

• code-bloat-wasp-drone

  Read-only code bloat audit for the bloat dimension of /audit-my-code. Measures copy-pasted code (jscpd), unused files, exports and dependencies (knip or language tools, spot-checked by hand), line counts (cloc or scc), and giant files, functions and closures (lizard), then writes 01-bloat findings,

• code-forensics-wasp-drone

  Review software and agency engagements from supplied contracts, invoices, communications and delivery evidence. Produce cited evidence drafts for human or counsel review. Use for an authorized forensic engagement, not routine code review or legal advice.

• code-foundation-wasp-drone

  Foundation (health) audit of a code repository for /audit-my-code. Checks Wasp Nest setup, AI agent readiness, CI, tests, lint, lockfiles, secrets hygiene and governance; writes findings, metrics and notes to the run workspace. Do NOT use to fix the repo.

• lovable-audit-wasp-drone

  Empirical security audit of Lovable-built Supabase apps: row-level-security denial verification, role-differential visibility probes, Edge Function gating checks, auth-posture readout, client-bundle key and endpoint forensics, findings triage against an operator risk taxonomy, and grounded reporting

• nextjs-security-wasp-drone

  Deep, evidence-backed Next.js security audit (versions 13 to 16, App and Pages Router) for an /audit-my-code run. Use when intake.json lists the nextjs stack, or when asked whether a Next.js app's version, middleware or proxy auth, Server Actions, Route Handlers, caching, or next.config are safe. Wr

• polyglot-security-wasp-drone

  Deep, read-only security audit of non-React, non-Next.js, non-SvelteKit code (Node servers, Python, Go, Rust, Rails, PHP, Spring, .NET) plus secrets, dependencies, static analysis, and CI/CD and infrastructure, writing SEC-POLY findings in the Audit My Code contract shape. Use when an /audit-my-code

• react-security-wasp-drone

  Deep, evidence-backed security audit of React 18 and 19 code for /audit-my-code. Use when stack routing sends react (or nextjs, for client patterns), or when asked to check XSS sinks, SSR injection, RSC runtime CVEs such as React2Shell, Server Functions, bundle secrets, client-side trust, or AI-buil

• remediation-planning-wasp-drone

  Turns Mario Audit findings into a remediation roadmap (Now, Next, Later), plan.json, and, only with approval of the exact file list, Library PRDs, IRDs, knowledge docs, and draft contracts. Run after the four audit dimensions. Do NOT use to implement fixes, scaffold library/, or accept contracts.

• sveltekit-security-wasp-drone

  Deep, evidence-backed, read-only security audit of Svelte 4/5 and SvelteKit 2 apps (and plain Svelte + Vite SPAs) on any stack, for an /audit-my-code run. Use when intake.json lists the svelte or sveltekit stack, or when asked whether a SvelteKit app's versions, load functions, form actions, +server

• swarm-audit-wasp-drone

  Swarm-audit scout, observer, and assembler. Use when the user asks for a swarm audit, a state of the union, an audit of every branch local and remote, where the team screwed up, or an ultracode fleet on a repository. Scouts and briefs the fleet, runs each 10-minute check-in (fails and stalls, kill a

Similar plugins