# Audit Output Template

Template for GitHub issues created by the audit skill.

## Issue Title Format

```
Audit: [Category] - [YYYY-MM-DD]
```

Examples:
- `Audit: Security - 2026-02-05`
- `Audit: Code Quality - 2026-02-05`

## Issue Labels

Always apply:
- `audit`

Category-specific:
- `security` - Security findings
- `dependencies` - Dependency findings
- `tos-compliance` - Terms of Service & Policy Compliance findings
- `code-quality` - Code quality findings
- `architecture` - Architecture findings
- `typescript` - TypeScript/React findings
- `testing` - Testing findings
- `documentation` - Documentation findings
- `performance` - Performance findings

Severity:
- `critical` - Critical severity
- `high` - High severity (omit for medium/low)

## Issue Body Template

```markdown
## Summary

| Metric | Value |
|--------|-------|
| **Audit Date** | YYYY-MM-DD |
| **Category** | [Category Name] |
| **Total Findings** | X |
| **Critical** | X |
| **High** | X |
| **Medium** | X |
| **Low** | X |
| **Scope** | [Entire repo / specific path] |

---

## Critical Findings

### 1. [Finding Title]

- **Severity**: Critical
- **File**: `path/to/file.ts:123`
- **Description**: [Clear description of the issue]
- **Impact**: [What could go wrong if not fixed]
- **Recommendation**: [How to fix it]

```typescript
// Example of problematic code
const badCode = ...
```

---

## High Severity Findings

### 2. [Finding Title]

- **Severity**: High
- **File**: `path/to/file.ts:456`
- **Description**: [Description]
- **Recommendation**: [Fix]

---

## Medium Severity Findings

<details>
<summary>3 medium severity findings (click to expand)</summary>

### 3. [Finding Title]
- **File**: `path/to/file.ts:789`
- **Description**: [Description]

### 4. [Finding Title]
- **File**: `path/to/other.ts:101`
- **Description**: [Description]

</details>

---

## Low Severity Findings

<details>
<summary>5 low severity findings (click to expand)</summary>

- `file1.ts:10` - [Brief description]
- `file2.ts:20` - [Brief description]
- `file3.ts:30` - [Brief description]

</details>

---

## References

- [Relevant documentation or standards]
- [OWASP guidelines if security]
- [Best practices links]

---

## Next Steps

- [ ] Review findings with team
- [ ] Prioritize fixes based on impact
- [ ] Create follow-up issues for complex fixes
- [ ] Re-run audit after fixes to verify

---

*Generated by `/audit` skill on YYYY-MM-DD*
```

## Fix Results Template (Self-Healing Mode)

When fixes were attempted, show this before the findings summary:

```markdown
## Fix Results

| Status | Count |
|--------|-------|
| ✅ Successfully fixed | X |
| ❌ Failed verification | Y |
| ⏭️ Skipped (human review) | Z |

### Commits Made
- `abc1234` audit: code-quality - Remove unused imports
- `def5678` audit: security - Remove console.log with user data
- `ghi9012` audit: typescript - Add return type to exported function

### Failed Fixes (Moved to Human Review)
These fixes were attempted but failed verification and were reverted:

1. **Add React.memo to ExpensiveList**
   - File: `src/components/ExpensiveList.tsx:15`
   - Failure: Type error - Props type incompatible with memo
   - Reverted: ✅

2. **Replace any with inferred type**
   - File: `src/utils/parser.ts:42`
   - Failure: Test failure in parser.test.ts
   - Reverted: ✅
```

## Rollback Instructions Template

Always show at the end when fixes were made:

```markdown
## Recovery

If you need to undo all audit fixes:
```bash
git reset --hard audit-checkpoint-YYYYMMDD-HHMMSS
```

Checkpoint branch: `audit-checkpoint-YYYYMMDD-HHMMSS`

To see what was changed:
```bash
git log audit-checkpoint-YYYYMMDD-HHMMSS..HEAD --oneline
```

To selectively revert a single fix:
```bash
git revert <commit-hash>
```
```

---

## Console Summary Template

When presenting to user before issue creation:

```markdown
# Audit Complete

## Fix Summary (if fixes were attempted)

| Status | Count |
|--------|-------|
| ✅ Successfully fixed | 8 |
| ❌ Failed verification | 2 |
| ⏭️ Skipped (human review) | 62 |

## Findings by Category

| Category         | Critical | High | Medium | Low | Fixed | Review |
|------------------|----------|------|--------|-----|-------|--------|
| Security         | 1        | 3    | 2      | 0   | 2     | 4      |
| Dependencies     | 0        | 2    | 5      | 3   | 3     | 7      |
| ToS & Compliance | 0        | 1    | 1      | 0   | 0     | 2      |
| Code Quality     | 0        | 1    | 8      | 12  | 3     | 18     |
| Architecture     | 0        | 2    | 3      | 1   | 0     | 6      |
| TypeScript/React | 0        | 0    | 4      | 6   | 0     | 10     |
| Testing          | 0        | 4    | 2      | 0   | 0     | 6      |
| Documentation    | 0        | 0    | 3      | 5   | 0     | 8      |
| Performance      | 0        | 1    | 2      | 2   | 0     | 5      |
| **Total**        | **1**    | **14** | **30** | **29** | **8** | **66** |

## Critical Findings (Immediate Action Required)

### 1. Hardcoded API Key in Production Code
- **Category**: Security
- **File**: `src/services/stripe.ts:15`
- **Details**: Production Stripe API key is hardcoded in source code

## Top High-Severity Findings

### 1. SQL Injection Vulnerability
- **Category**: Security
- **File**: `src/api/users.ts:45`

### 2. Missing Auth Check on Admin Endpoint
- **Category**: Security
- **File**: `src/api/admin.ts:23`

### 3. 47 npm Vulnerabilities (12 High)
- **Category**: Dependencies
- **Run**: `npm audit` for details

[... more high findings ...]

---

## Commits Made (if fixes were applied)
- `abc1234` audit: code-quality - Remove unused imports in UserService
- `def5678` audit: security - Remove console.log with user data
- `ghi9012` audit: dependencies - npm audit fix (3 vulnerabilities)

## Recovery

If you need to undo all audit fixes:
```bash
git reset --hard audit-checkpoint-20260205-143052
```

---

## Issue Creation Options

I found **1 critical** and **13 high** severity findings.

Options:
1. **Create issues for Critical + High** (recommended)
2. **Create issues for Critical only**
3. **Show detailed findings first**
4. **Skip issue creation**

What would you like to do?
```

## Updating Existing Issues

When an audit issue already exists for a category:

```markdown
## Audit Update - [YYYY-MM-DD]

### Changes Since Last Audit

| Status | Count |
|--------|-------|
| **New findings** | X |
| **Resolved** | X |
| **Still open** | X |

### New Findings

[List new findings not in previous audit]

### Resolved Issues

The following issues from the previous audit appear to be fixed:
- [x] `file.ts:123` - [Previous finding that's now resolved]

### Still Outstanding

The following issues remain from the previous audit:
- [ ] `file.ts:456` - [Still present]

---

*Updated by `/audit` skill on YYYY-MM-DD*
```

---

## Multi-Agent PR Template

Used by `--collect` mode when creating the combined audit PR.

### PR Title Format

```
Audit: YYYY-MM-DD - Distributed Codebase Audit
```

### PR Body Template

```markdown
## Distributed Codebase Audit - YYYY-MM-DD

### Summary

| Metric | Value |
|--------|-------|
| **Audit Date** | YYYY-MM-DD |
| **Base Branch** | {base_branch} |
| **Agents Used** | 4 |
| **Total Findings** | XX |
| **Auto-Fixed** | XX |
| **Human Review Needed** | XX |

### Findings by Category

| Category | Agent | Critical | High | Medium | Low | Fixed | Review |
|----------|-------|----------|------|--------|-----|-------|--------|
| Security | 0 | X | X | X | X | X | X |
| Dependencies | 0 | X | X | X | X | X | X |
| ToS & Compliance | 0 | X | X | X | X | X | X |
| Code Quality | 1 | X | X | X | X | X | X |
| TypeScript/React | 1 | X | X | X | X | X | X |
| Architecture | 2 | X | X | X | X | X | X |
| Performance | 2 | X | X | X | X | X | X |
| Testing | 3 | X | X | X | X | X | X |
| Documentation | 3 | X | X | X | X | X | X |
| **Total** | | **X** | **X** | **X** | **X** | **X** | **X** |

### Critical Findings (Immediate Action Required)

[List all critical findings across all agents]

### Agent Breakdown

<details>
<summary>Agent 0 - Security, Dependencies & ToS (XX findings, XX fixed)</summary>

#### Commits
- `abc1234` audit(security): remove PII-leaking console.log
- `def5678` audit(dependencies): npm audit fix

#### Fixes That Failed Verification
- **[Title]** - `file.ts:line` - [failure reason]

#### Findings Needing Human Review
1. **[Title]** - `file.ts:line` - [description]

</details>

<details>
<summary>Agent 1 - Code Quality & TypeScript (XX findings, XX fixed)</summary>

[Same structure as Agent 0]

</details>

<details>
<summary>Agent 2 - Architecture & Performance (XX findings, XX fixed)</summary>

[Same structure as Agent 0]

</details>

<details>
<summary>Agent 3 - Testing & Documentation (XX findings, XX fixed)</summary>

[Same structure as Agent 0]

</details>

### Cross-Category Findings

Findings discovered by one agent but belonging to another agent's category.
These may not have been fixed if the owning agent didn't encounter them independently.

| Finding | Discovered By | Belongs To | Status |
|---------|---------------|------------|--------|
| [Title] | Agent 0 | Code Quality | [Fixed by Agent 1 / Unfixed] |

### Merge Details

| Agent | Branch | Commits | Merge Status |
|-------|--------|---------|-------------- |
| 0 | `audit/agent-0-YYYYMMDD` | X | Clean merge |
| 1 | `audit/agent-1-YYYYMMDD` | X | Clean merge |
| 2 | `audit/agent-2-YYYYMMDD` | X | Clean merge |
| 3 | `audit/agent-3-YYYYMMDD` | X | X conflicts resolved |

### Recovery

To undo all audit changes:
```bash
git revert --no-commit HEAD~N..HEAD  # Where N = total commits
git commit -m "revert: undo audit YYYY-MM-DD"
```

Or reset the branch:
```bash
git reset --hard origin/{base_branch}
```
```

---

## No Findings Template

When a category has no findings:

```markdown
## Audit: [Category] - [YYYY-MM-DD]

**No issues found.**

The [category] audit completed successfully with no findings above the configured severity threshold (Critical/High).

### What Was Checked

- [List of things checked]
- [Another thing]
- [etc.]

---

*Generated by `/audit` skill on YYYY-MM-DD*
```