production-code-auditDeep-scan a codebase, understand its architecture and patterns, then produce a comprehensive audit report with prioritized fixes. Optionally apply changes on...
Install via ClawdBot CLI:
clawdbot install solomonneas/production-code-auditGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Calls external URL not in known-safe list
https://owasp.org/www-project-top-ten/Audited Apr 16, 2026 · audit v1.0
Generated Oct 5, 2026
A Series A SaaS startup preparing for its public launch wants a complete security and production-readiness audit of its Node.js/PostgreSQL codebase. The skill scans for SQL injection, hardcoded secrets, and missing auth, then applies fixes on a draft PR for the CTO to review before merge.
An e-commerce company runs a 7-year-old Express + React storefront with N+1 queries and no test coverage. The audit identifies 100+ issues across performance, testing, and architecture, and fix mode adds caching, parameterized queries, and integration tests on a dedicated branch.
A fintech team facing SOC 2 and PCI-DSS review needs documented evidence of secure coding practices. The skill produces a prioritized report covering weak password hashing (MD5 → bcrypt), CSRF gaps, and missing secrets rotation, giving auditors a clear remediation trail.
A software agency takes over a hastily built Django project from an offshore contractor. The production-code-audit skill maps architecture, flags god classes and circular dependencies, and delivers a before/after metrics report the agency can present to its client.
A health-tech company must harden a HIPAA-adjacent patient data API before deployment. The audit checks missing input validation, unescaped output (XSS), and absent health checks, then adds logging, monitoring, and error tracking on an audit/production-hardening branch.
Offer the production-code-audit skill as a free open-source CLI to drive adoption, with a paid cloud dashboard for team-level audit history, scheduled scans, and compliance reporting. Monetizes teams that need recurring audits rather than one-off scans.
License the skill to development agencies and consultancies as a white-labeled audit engine they run on client codebases. Agencies charge clients a fixed fee for the report and remediation, while paying a per-seat or per-audit platform fee.
Sell to enterprises that need SOC 2, PCI-DSS, or ISO 27001 evidence by bundling the skill with policy templates, audit trails, and CI/CD integration. The skill's report generation becomes the evidence artifact for auditors, commanding premium pricing.
💬 Integration Tip
Run the skill in audit mode first on a separate clone or read-only checkout to avoid accidental modifications before reviewing findings. For fix mode, ensure the repo has a clean working tree and CI configured so the draft PR's test runs validate changes automatically.
Scored Oct 5, 2026
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Security scanner for AI agent skills. 9 built-in detection signatures. Identifies secrets, unsafe execution patterns, and prompt injection. Sub-50ms results.
Wallet anti-theft guard. One-click scan for high-risk wallet approvals to protect user assets. Use when a user asks for a wallet security check, wallet healt...
Comprehensive security audit for an agent's full skill stack. Chains scanner, differ, trust-verifier, and health-monitor into a single assessment with priori...
GEO Audit — AI Search Visibility Checker for ChatGPT, Perplexity, Claude & Gemini. 29-point GEO readiness checklist: robots.txt AI crawler access, Index...
Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST sc...