codebase-audit

80 / 100 · Low risk

Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.

By TencentCloudBase/CloudBase-AI-Toolkit (GitHub) · coding · 1,164 stars · scanned at commit 640a67d

Perform a full codebase review, categorize findings by severity, file GitHub issues, then fix each issue in an isolated git worktree and submit PRs. Use this skill when the user asks to audit the codebase, do a comprehensive code review, find and fix security/quality/reliability issues, or run a proactive health check across the entire repository.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. It runs automatically when the plugin is installed. Expected for a coding skill.

Found in 10 places.

skills/codebase-audit/SKILL.md, line 63gh issue create --title "<type>(<scope>): <summary>" --body "<structured body>" --label "<severity>,<category>"
skills/codebase-audit/SKILL.md, line 75git worktree add ../<repo>-audit-fix-<issue-number> -b fix/<slug>-<issue-number> origin/main
skills/codebase-audit/SKILL.md, line 82git commit -m 'fix(<scope>): 🔒 <english description>

Show 7 more

skills/codebase-audit/SKILL.md, line 88git push github fix/<slug>-<issue-number>
skills/codebase-audit/SKILL.md, line 93cd <original-dir>
skills/codebase-audit/SKILL.md, line 104gh pr checks <number>
skills/codebase-audit/references/review-strategy.md, line 29| Command injection | String interpolation in `exec()`, `execSync()`, shell commands | CRITICAL |
skills/codebase-audit/references/security-severity-checklist.md, line 31- [ ] `exec()`, `execSync()`, `spawn()` with unsanitized user input
skills/codebase-audit/references/security-severity-checklist.md, line 34- [ ] Shell command string interpolation in `child_process` calls
gemini-extension.json, line 14"command": "npx",

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed.

Found in 1 place.

gemini-extension.json, line 14"command": "npx",

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'codebase-audit' ] || [ -L ~/.agents/skills/'codebase-audit' ]; then echo 'A skill folder named codebase-audit already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/TencentCloudBase/CloudBase-AI-Toolkit' "$d" && git -C "$d" checkout --quiet '640a67d41af13774c11372ccef8c5a35c06042bc' -- 'skills/codebase-audit' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/codebase-audit' ~/.agents/skills/'codebase-audit' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'codebase-audit' ~/.claude/skills/'codebase-audit' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for TencentCloudBase/CloudBase-AI-Toolkit shows the score of its lowest-scoring skill.

SkillTrust badge for TencentCloudBase/CloudBase-AI-Toolkit

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/TencentCloudBase/CloudBase-AI-Toolkit.svg)](https://zalavijaysinh.github.io/skilltrust/repos/TencentCloudBase/CloudBase-AI-Toolkit/)

Score history

Date	Version	Score
2026-11-11	`640a67d`	80
2026-11-08	`8ec7084`	80
2026-11-07	`8ec7084`	80