production-code-audit

Q: How do I install production-code-audit?

Run npx skills add https://github.com/sickn33/agentic-awesome-skills --skill production-code-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/production-code-audit/ (personal) or .claude/skills/production-code-audit/ (project).

by sickn33Security

Audit an explicitly scoped codebase for evidenced security, correctness and performance issues; implement authorized targeted repairs and report validation plus residual readiness gaps.

Installs: 1.3K
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/sickn33/agentic-awesome-skills --skill production-code-audit

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads production-code-audit automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Production Code Audit

Detailed Guide

Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

When to Use This Skill

Use when user says "make this production-ready"
Use when user says "audit my codebase"
Use when user says "make this professional/corporate-level"
Use when user says "optimize everything"
Use when user wants enterprise-grade quality
Use when preparing for production deployment
Use when code needs to meet corporate standards

Worked Example: Query Repair

For a request-controlled email used in a concatenated PostgreSQL query, trace the input and confirm the driver, then replace concatenation with its parameter-binding API:

// pg-compatible example; driver and database fixtures must be supplied.
const result = await db.query('SELECT id FROM users WHERE email = $1', [email]);

Validate a normal match, no match and a synthetic quote-containing input. Record actual commands and results; do not assert the test passed from the snippet alone. If a credential was found, removing it from source does not revoke it: report rotation and history/artifact exposure to the authorized owner without copying the value.

Output Example (Illustrative Structure)

Scope: repository, base/head, files fully read, excluded/unavailable files.
Finding: path:line, trigger, observed behavior, impact and severity rationale.
Repair: minimal change and why it preserves the intended behavior.
Validation: command/environment/result, or explicitly not run with reason.
Remaining gaps: unsupported runtime, unreviewed deployment, external configuration.
Readiness: evidence available and specific unresolved criteria; no blanket certification.

Any metrics must come from reproducible measurements with dataset, environment and baseline/head. Zero scanner findings does not mean zero vulnerabilities, and OWASP Top 10 is an awareness list rather than a “compliance” certificate. An audit request does not authorize deploying, provisioning telemetry/caches or contacting third parties.

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

FAQ

What does the production-code-audit skill do?

Audit an explicitly scoped codebase for evidenced security, correctness and performance issues; implement authorized targeted repairs and report validation plus residual readiness gaps.

How do I install production-code-audit?

Run npx skills add https://github.com/sickn33/agentic-awesome-skills --skill production-code-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/production-code-audit/ (personal) or .claude/skills/production-code-audit/ (project).

Which AI agents can use production-code-audit?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is production-code-audit safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains production-code-audit?

It is published by sickn33 in sickn33/agentic-awesome-skills. It has 1,254 recorded installs.