---
argument-hint: <input — text, URL, file path, code snippet, config, claim, or process description>
description: Parallel audit — chunks input into dimensions, spawns parallel auditors, synthesizes a final 'is it legit' verdict
allowed-tools: Read, Write, Bash, Glob, Grep, Agent, mcp__playwright__browser_navigate, mcp__playwright__browser_snapshot, mcp__playwright__browser_take_screenshot, mcp__playwright__browser_evaluate
---

# /audit — Parallel Audit with Verdict

Decompose any input into audit dimensions, run them as parallel agents, then synthesize a final **"is it legit"** verdict using Opus.

Input: **$ARGUMENTS**

---

## Phase 0: Setup

**Set audit flag** (suppresses verify-gate hook during this audit — it fires on every agent and would serialize the parallel flow):

Run this Bash command to set the flag (resolves CLAUDEBOOST_HOME dynamically):
```bash
"${CLAUDEBOOST_PYTHON}" -c "import os,json,pathlib; p=pathlib.Path(os.environ.get('CLAUDEBOOST_HOME',''))/'state'/'audit-in-progress.json'; p.write_text(json.dumps({'active':True}))"

0a — Detect project path (before loading context):

Run "${CLAUDEBOOST_PYTHON}" "${CLAUDEBOOST_HOME}/scripts/get-active-workspace.py" to get the active workspace ID for this Claude instance (same source as the blue WS indicator in the statusline — per-instance, not shared across windows). The output is JSON with workspace_id, workspace_path, and project_path. Fall back to current working directory if no workspace is active.

Set PROJECT_PATH to the detected value.

Then call POST http://127.0.0.1:8612/context with agent="reviewer-agent", task_description="audit: $ARGUMENTS", project_path="<PROJECT_PATH>", max_tokens=3000.

0b — Verify project is indexed (required for codebase search to work):

Call GET http://127.0.0.1:8612/status and check indexed_projects for PROJECT_PATH.

Indexed: note file/chunk counts and continue.
Not indexed: run Skill(skill="index-project", args="<PROJECT_PATH>") immediately. Do not continue until indexing completes.
RAG offline: stop and tell the user to run /rag first.

Phase 1: Input Analysis

1a — Determine input type

Examine $ARGUMENTS and classify it as one of:

Type	Detection signals
`code`	Contains code syntax, starts with a code fence, has braces/semicolons/indentation, mentions a function/class/method
`file`	Looks like a file path (contains `/` or `\`, has an extension like `.py .ts .cs .json .yaml`)
`url`	Starts with `http://` or `https://`, or is a bare domain/path that looks like a link
`config`	JSON, YAML, TOML, XML, or key=value structure — configuration data
`claim`	A factual assertion, statement, or short text being verified for accuracy
`document`	Multi-paragraph text, a pasted document, a ticket description, a spec
`process`	Describes a workflow, sequence of steps, or plan
`output`	The result of an agent, skill, or task execution. Contains claims that certain work was done, findings that were produced, or artifacts that were created. Typically a file path (plan.md, prd.md, exploration.md) or quoted agent output.

Set INPUT_TYPE.

1b — Fetch or read the content

If file: Read the file at the given path. Store full contents as INPUT_CONTENT. Set STATED_GOAL = "Not provided — audit internal consistency only."

If url:

Safety check first — if the URL matches any non-localhost pattern (staging, prod, .com, .io, .net, etc. that is NOT localhost or 127.0.0.1): this is a legitimate audit target. Proceed with browser navigation.

Navigate to the URL:

browser_navigate(url="$ARGUMENTS")
browser_snapshot()

Store the page text and visible content as INPUT_CONTENT. Set STATED_GOAL = "Not provided — audit internal consistency only."

If code, config, claim, document, process: INPUT_CONTENT = $ARGUMENTS verbatim (already in hand). Set STATED_GOAL = "Not provided — audit internal consistency only."

If output: Read the file(s) at the given path. If multiple files are implied, read all of them. Store full contents as INPUT_CONTENT. Also note the stated goal or ticket as STATED_GOAL — check for ticket.md or context.md in the same workspace directory (e.g., if input is workspace/task-id/plan.md, look for workspace/task-id/ticket.md). If found, store first 500 chars as STATED_GOAL. If not found, set STATED_GOAL = "Not provided — audit internal consistency only.".

1c — Summarize in one sentence

Write: "Auditing: [one sentence describing what this is and what it claims to be or do]"

1d — Detect audit scope

If INPUT_TYPE is output, OR the user's request contains "verify completion", "check if done", "did this happen", or "was this actually done": Set AUDIT_SCOPE = completion-verification

Otherwise: Set AUDIT_SCOPE = general

Phase 2: Dimension Selection

Choose 3–6 dimensions from the tables below based on INPUT_TYPE. Be decisive — fewer targeted dimensions beat many shallow ones.

Dimension bank by input type

code or file (code file):

ID	Dimension	Focus
C1	Logic & Correctness	Does it do what it claims? Any bugs, wrong conditions, off-by-one errors?
C2	Security	Injection, auth bypass, data exposure, hardcoded secrets, OWASP top 10
C3	Error Handling	Are all error paths covered? Silent failures? Missing try/catch?
C4	Performance	N+1 queries, blocking loops, memory leaks, unnecessary allocations
C5	Completeness	Missing cases, dead code, TODO remnants, unreachable branches
C6	Conventions	Naming, structure, patterns — does it match how this codebase solves similar problems?

config:

ID	Dimension	Focus
CF1	Schema Validity	Conforms to expected format, required fields present, correct value types
CF2	Security	Ex
```