sdlc-audit

Plugin sdlc-audit from marketplace shakhoff-claude-marketplace in shakhovskiya-create/shakhoff-claude-marketplace. Commands read from the repo's manifest — 1 month ago.

Skills (17)

• architecture-audit

  Audit project architecture: C4 inferred from code, ADR coverage, deep modules check, accidental complexity, layering violations, cyclic dependencies. Use during /audit:architecture or /audit:full architecture phase.

• audit-orchestrator

  Orchestrates full SDLC audit across all phases. Use when running /audit:full or coordinating multiple audit phases. Manages depth control, scope, output artifacts, and final reporting.

• audit-trends

  Aggregates audit snapshots from docs/audit/* into trend report. Computes deltas (new/fixed/reopened/lingering), health score, MTTR, phase regressions. Used by /audit:trends.

• backlog-generator

  Generate actionable BACKLOG.md from classified findings. Sorts by priority, creates fix prompts ready for /audit:fix command.

• code-audit

  Audit code quality: SOLID violations, complexity hotspots, duplication, dead code, code smells. Multi-language. Uses tooling-python, tooling-js-ts, tooling-go skills for SAST.

• deploy-audit

  Audit deployment: CI/CD pipelines, IaC configurations, container security, secrets management, supply chain, deployment strategy.

• docs-audit

  Audit documentation: drift between docs and code, ADR coverage gaps, README quality, missing API docs, outdated examples.

• domain-audit

  Audit business domain logic via DDD lens: bounded contexts, anaemic models, invariant protection, logic leakage, primitive obsession, ubiquitous language consistency. Use during /audit:domain or /audit:full domain phase.

• findings-classifier

  Classify, deduplicate, and assign severity to audit findings. Use after all audit phases complete to produce final priority-ordered list.

• language-detector

  Detect languages and frameworks used in a project to select appropriate audit tooling. Returns detection report with language stats, frameworks, and suggested tools per language.

• performance-audit

  Static + dynamic performance audit. Detects n+1 patterns, sync IO in hot paths, allocation hot spots, missing memoization. Reads .perf-budgets.yaml when present. Optional pprof/clinic.js parsing.

• security-audit

  Security audit: SAST scanning, secrets detection, OWASP Top 10, dependency CVEs, configuration review, auth/authz analysis. Multi-language.

• test-audit

  Audit test quality: coverage (statement+branch), mutation score, test pyramid, flakiness, AAA structure, naming. Multi-language. Uses tooling-* skills for coverage and mutation runners.

• tooling-go

  Go audit tooling: golangci-lint, gosec (SAST), govulncheck (CVEs), staticcheck, gocyclo, deadcode, go-mutesting (mutations). Use during audit phases for Go projects.

• tooling-js-ts

  JavaScript/TypeScript audit tooling: ESLint, tsc, vitest/jest coverage, knip (dead code), retire.js, npm audit, Stryker (mutations), madge (cycles). Use during audit phases for JS/TS projects.

• tooling-python

  Python audit tooling: ruff (linting), mypy (types), bandit (SAST), pip-audit (CVEs), radon (complexity), vulture (dead code), mutmut (mutations). Use during audit phases for Python projects.

• ux-a11y-audit

  WCAG 2.2 AA accessibility audit. Static checks (missing alt, contrast, label association, focus order) plus optional axe-core dynamic run on routes. Used by /audit:ux-a11y.

Slash commands (16)

• /sdlc-audit:audit-architecture

  Audit project architecture: C4 inferred from code, ADR coverage, deep modules check, accidental complexity. Standalone command, can run independently of /audit:full.

• /sdlc-audit:audit-code

  Audit code quality: SOLID violations, complexity hotspots, duplication, dead code, code smells. Multi-language: Python, JS/TS, Go.

• /sdlc-audit:audit-codex

  Request a second opinion from Codex CLI on a specific finding, file, decision, or area. Requires codex-plugin-cc to be installed.

• /sdlc-audit:audit-deploy

  Audit deployment: CI/CD pipelines, IaC, secrets management, container security, supply chain.

• /sdlc-audit:audit-docs

  Audit documentation: drift between docs and code, ADR coverage gaps, README quality, missing API docs.

• /sdlc-audit:audit-domain

  Audit business domain logic: bounded contexts, anaemic models, invariant violations, leaking domain logic. Standalone command.

• /sdlc-audit:audit-fix

  Apply fixes from the audit backlog. Use 'next' for highest-priority unfixed finding, specific ID, or filter by severity.

• /sdlc-audit:audit-full

  Run full SDLC audit on the project. Covers architecture, domain logic, code, tests, security, docs, deployment. Use --depth=quick|standard|deep to control thoroughness.

• /sdlc-audit:audit-performance

  Performance audit phase. Static heuristics (n+1 patterns, sync IO in hot path, large allocations, busy loops) plus optional dynamic checks if benchmarks/profiles available.

• /sdlc-audit:audit-prioritize

  Re-order audit BACKLOG by business-weighted impact. Considers severity × file-criticality × delta vs prev audit × business tags from .audit-priorities.yaml. Output top-K with rationale.

• /sdlc-audit:audit-security

  Security audit: SAST, secrets in code, OWASP Top 10, dependency CVEs, supply chain risks.

• /sdlc-audit:audit-sprint

  Bridge audit BACKLOG.md to ai-scrum. Selects findings (by id, severity, or 'next'), maps verification_checklist to AC, effort to size, and emits an ai-scrum-ready plan. Optionally hands off to /sprint:start.

• /sdlc-audit:audit-status

  Show status of the latest audit: findings count by severity, fixed/open ratio, top critical issues.

• /sdlc-audit:audit-tests

  Audit tests: coverage (statement+branch), mutation score, pyramid distribution, flakiness, AAA structure. Multi-language.

• /sdlc-audit:audit-trends

  Aggregate snapshots from docs/audit/* into a trend report. Tracks health score, new/fixed/reopened findings, phase regressions, MTTR, recurring categories. Output: AUDIT_TRENDS.md/json + optional HTML.

• /sdlc-audit:audit-ux-a11y

  UX + accessibility audit. WCAG 2.2 AA checks via axe-core when frontend present, plus heuristics on keyboard flow, contrast, focus management, semantic HTML. Static + optional headless browser.

Subagents (10)

• architecture-auditor

  Subagent for architecture phase of SDLC audit. Reverse-engineers C4 model, finds ADR gaps, detects layering violations, cyclic dependencies, god modules. Use during /audit:architecture or as part of /audit:full architecture phase.

• code-auditor

  Subagent for code quality phase of SDLC audit. Runs SAST tools, identifies SOLID violations, complexity hotspots, duplication, dead code. Multi-language. Use during /audit:code.

• codex-second-opinion

  Subagent for invoking Codex CLI as independent reviewer on a specific finding, file, or decision. Used by /audit:codex command. Falls back to DeepSeek via OpenRouter if Codex unavailable.

• deploy-auditor

  Subagent for deployment phase of SDLC audit. Reviews CI/CD pipelines, IaC, container security, secrets management, supply chain. Use during /audit:deploy.

• docs-auditor

  Subagent for documentation phase of SDLC audit. Detects docs drift, ADR coverage gaps, README quality, API doc completeness, outdated examples. Use during /audit:docs.

• domain-auditor

  Subagent for domain phase of SDLC audit. Identifies bounded contexts, anaemic models, invariant violations, logic leakage, primitive obsession. Use during /audit:domain or as part of /audit:full domain phase.

• performance-auditor

  Subagent for performance phase of SDLC audit. Runs static heuristics, parses optional profiles, checks .perf-budgets.yaml. Use during /audit:performance or as part of /audit:full when --include=perf set.

• security-auditor

  Subagent for security phase of SDLC audit. Runs SAST, secret detection, OWASP checks, dependency CVE scan, configuration review, auth/authz analysis. Use during /audit:security.

• test-auditor

  Subagent for tests phase of SDLC audit. Analyzes coverage, mutation score, test pyramid, AAA structure, flakiness, naming. Multi-language. Use during /audit:tests.

• ux-a11y-auditor

  Subagent for UX/accessibility phase of SDLC audit. Static WCAG 2.2 AA checks plus optional axe-core dynamic scans. Use during /audit:ux-a11y or as part of /audit:full when --include=ux set.

Similar plugins