production-code-audit – skill Bảo mật cho agent AI

Production Code Audit

Detailed Guide

Read [the detailed guide](references/detailed-guide.md) before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.

When to Use This Skill

• Use when user says "make this production-ready"
• Use when user says "audit my codebase"
• Use when user says "make this professional/corporate-level"
• Use when user says "optimize everything"
• Use when user wants enterprise-grade quality
• Use when preparing for production deployment
• Use when code needs to meet corporate standards

Worked Example: Query Repair

For a request-controlled email used in a concatenated PostgreSQL query, trace the input and confirm the driver, then replace concatenation with its parameter-binding API:

// pg-compatible example; driver and database fixtures must be supplied.
const result = await db.query('SELECT id FROM users WHERE email = $1', [email]);

Validate a normal match, no match and a synthetic quote-containing input. Record actual commands and results; do not assert the test passed from the snippet alone. If a credential was found, removing it from source does not revoke it: report rotation and history/artifact exposure to the authorized owner without copying the value.

Output Example (Illustrative Structure)

Scope: repository, base/head, files fully read, excluded/unavailable files.
Finding: path:line, trigger, observed behavior, impact and severity rationale.
Repair: minimal change and why it preserves the intended behavior.
Validation: command/environment/result, or explicitly not run with reason.
Remaining gaps: unsupported runtime, unreviewed deployment, external configuration.
Readiness: evidence available and specific unresolved criteria; no blanket certification.

Any metrics must come from reproducible measurements with dataset, environment and baseline/head. Zero scanner findings does not mean zero vulnerabilities, and OWASP Top 10 is an awareness list rather than a “compliance” certificate. An audit request does not authorize deploying, provisioning telemetry/caches or contacting third parties.

Limitations

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.