audit

Audit GitHub Actions workflows for what costs wall clock, costs money, or lets a pipeline pass without checking anything. Builds the job graph, then runs a catalog covering gating correctness, the critical path, caching effectiveness, and spend. Reads and reports only; never edits a workflow.

Find the React problems linters cannot see: effects that should not exist or re-run for the wrong reason, memoization that is missing or pointless, state that should be an action or a reducer, and components that have outgrown themselves. Reports, never edits.

Audit package.json scripts for naming, composition, lifecycle hooks, consistency, and performance.

Audit a repository for security risks — supply chain, CI, release, runtime, secrets, repository settings, and package-manager install-time controls for pnpm and bun. Reads and reports only; never mutates the repo or its GitHub settings. Aggregates findings from focused subagents across whichever areas the repo exposes.

Audit Agent Skills for what no validator can decide: whether a description will ever fire, whether the instructions are followable, whether the body earns its token cost, whether `compatibility` matches what the body requires, and whether mutations are gated. Runs the repo's structural validators first, scores six judgment categories with cited evidence, and returns a PASS / FAIL verdict.

Audit an existing test suite for anti-patterns — tautological mock round-trips, weak assertions (toBeDefined / assertNotNull), implementation coupling, flaky timing, snapshot rubber-stamping, and tests claiming guarantees they cannot provide — and report a keep / tighten / rewrite / delete verdict per test.

Audit Three.js and React Three Fiber code for performance and correctness issues that hurt frame rate in WebGL scenes — uncapped devicePixelRatio, fillrate blowups, missing disposals, render-loop allocations, and similar pitfalls. Walks through detecting each issue, assessing the offending sites in context, and reporting findings grouped by severity.

Audit tsconfig.json against TypeScript 7 and report which compilerOptions are hard errors, which are redundant and safe to drop, and which must now be added.

Audit a pnpm 10+ workspace for configuration and monorepo problems: dependency placement, workspace protocol usage, hoisting, catalog configuration, build order and build hooks, dependency rules, and .npmrc settings that are now defaults. Reads and reports only.