---
title: "code-audit-tools"
description: "Audit repositories and app security, measure bloat, inspect branches and plan remediation."
canonical: https://agentpluginsdirectory.com/plugins/code-audit-tools
last-updated: 2026-10-21
---

# code-audit-tools
Audit repositories and app security, measure bloat, inspect branches and plan remediation.
- Slug: code-audit-tools
- Publisher: Legion Code Inc.
- Repository: https://github.com/legioncodeinc/vibe-coding-tools
- Manifest: plugins/code-audit-tools/plugin.json
- Version: 3.0.1
- License: AGPL-3.0-or-later
- Category (editorial): other
- Skills: 13 (audit-my-code-stinger, code-audit-brief-stinger, code-bloat-stinger, code-forensics-stinger, code-foundation-stinger, lovable-audit-stinger, nextjs-security-stinger, polyglot-security-stinger, react-security-stinger, remediation-planning-stinger, source-command-audit-my-code, sveltekit-security-stinger, swarm-audit-stinger)
- MCP servers: 0
- Stars: 94
- Repository created: 2026-05-23
- Repository last pushed: 2026-10-18
- Publisher type: Organization
- Listing: https://agentpluginsdirectory.com/plugins/code-audit-tools
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What code-audit-tools does, in the publisher's words

Audit repositories and app security, measure bloat, inspect branches and plan remediation.

Code and owned-app investigation use source/effect evidence and stack-specific security. They must not inherit passive website permissions.

Requires wasp-nest-core.

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/legioncodeinc/vibe-coding-tools/HEAD/plugins/code-audit-tools/README.md

## Skills

- audit-my-code-stinger: Orchestrates /audit-my-code. Five tiers (foundation, vibe, basic, full, mario) of codebase audits, dispatched to paired Drones and delivered as a Legion Code Inc. brief.
- code-audit-brief-stinger: Render the Audit My Code brief, one self-contained Field Guide styled HTML file per run, from the workspace only. Escapes repo text, merges duplicates, prints cleanly to PDF.
- code-bloat-stinger: Read-only bloat audit of any repo. jscpd duplication, knip or language dead-code tools with a spot-check, cloc size, function and closure structure, split plans, banded verdict.
- code-forensics-stinger: Review software vendor engagements using contracts, invoices, messages and delivery records. Produce cited evidence drafts for human or counsel review. Read README.md for the guide map.
- code-foundation-stinger: Read-only repo health audit: Wasp Nest setup, agent readiness, CI, tests, lint, lockfiles, secrets, governance. Writes contract-shaped foundation findings and measures. Never edits the repo.
- lovable-audit-stinger: Audit Lovable-built Supabase apps: RLS denials, role-differential reads, function gating, auth posture, bundle-forensics key/endpoint extraction, findings triage, reporting.
- nextjs-security-stinger: Deep Next.js security audit (13 to 16, App and Pages Router). Version advisories, proxy and middleware auth, Server Actions, Route Handlers, data exposure, caching, config. Read-only.
- polyglot-security-stinger: Deep security audit for Node servers, Python, Go, Rust, Rails, PHP, Spring, and.NET, plus secrets, dependencies, SAST, and CI. Read-only, writes Audit My Code findings.
- react-security-stinger: Review React 18/19 security, including Next.js clients. Covers XSS, secrets and client trust. Delegate Next.js server surfaces to nextjs-security-stinger. Read-only.
- remediation-planning-stinger: Plan fixes from audit findings. Clusters findings into work packages, orders Now, Next, Later, and with approval writes Library PRDs, IRDs, knowledge docs, and draft contracts.
- source-command-audit-my-code: Audit a codebase the way Legion Code Inc. does: foundation health, duplication and dead code, framework-deep security, quality, and a remediation plan, delivered as a branded brief.
- sveltekit-security-stinger: Evidence-backed, read-only security audit of Svelte 4/5 and SvelteKit 2 apps, any stack. Versions vs advisories, load leaks, actions, remote functions, hooks, XSS, CSRF, adapters.
- swarm-audit-stinger

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.