Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Runs a structured two-pass code audit using six specialist roles: security, performance, UX, DX, edge case, and a tie-breaker lead. Each role analyzes the target codebase independently, then a reconciliation pass resolves conflicts and merges findings into one report ordered by severity, blast radius, and exploitability. File references, reproduction steps, and regression test suggestions are included for each finding.
Replaces ad-hoc single-angle reviews with one structured pass covering security, performance, UX, DX, and edge cases simultaneously, producing a single prioritized report instead of fragmented per-discipline feedback.
When to use it
- Auditing a pull request before merging to production
- Generating a risk-ranked remediation plan for a legacy service
- Finding security and performance gaps across API endpoints
- Stress-testing a codebase for edge cases and invariant violations
- Pre-launch review of backend and frontend code
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Audit my Express API codebase for security vulnerabilities and performance issues
- 1Read code and product flows to identify assets, entry points, trust boundaries, and high-risk operations
- 2Map critical invariants across all mutating paths including HTTP routes, webhooks, and async jobs
- 3Run specialist reviews in sequence: security, performance, UX, DX, edge case master
- 4Tie-breaker lead resolves conflicts, removes duplicates, and assigns severity and confidence to each finding
- 5Run cross-review pass 2 with specialists reassessing prior and edge-triggered findings
- 6Publish final report ordered by severity with file references, concrete fixes, and verification tests
Prioritized findings report with severity ratings, file references, reproduction steps, a remediation plan, and an executive summary