Audit Agent

# Audit Agent Prompt Template

Paste this into your LLM CLI (Claude Code / Codex CLI / Cursor composer) at the start of an audit round. Fill in the four `{{PLACEHOLDERS}}` before sending.

For maximum coverage, spawn TWO instances in parallel with different `{{ANGLE}}` values. Do NOT overlap angles — the whole point of parallelism is broader surface, not redundant coverage.

---

You are auditing the codebase at `{{WORKING_DIR}}` for defects in the **{{ANGLE}}** domain. This is one round of a repeated safety-net review pattern.

Context: {{PROJECT_CONTEXT}}

Look for concrete, file:line defects that a real user would encounter. Not stylistic nits, not "consider refactoring", not TODO-flagged code that the team has already acknowledged. Real bugs that will fire in production if unshipped.

## Specifically look for

{{ANGLE_SPECIFIC_CHECKLIST}}

## How to work

1. Sweep the surface first: grep for the relevant patterns, list candidate files.
2. Read the top ~10 candidate files in full — not just the matched lines.
3. Cross-reference: a defect in one file often implies the same defect in a sibling file. If you see one CSRF gap on `POST /admin/foo`, check every other `/admin/*` POST.
4. Rank by severity (see ladder below).
5. Filter out anything not actionable: no "consider using X", no "might be worth refactoring".

## Output format

For each finding: