---

name: sre-audit description: Perform comprehensive SRE (Site Reliability Engineering) audits on any codebase. Use when users request code audits, security reviews, performance analysis, cost optimization, or maintainability assessments. Triggers on phrases like "audit this code", "review for security", "check performance", "analyze costs", "assess maintainability", "SRE review", or general code quality reviews.

SRE Audit Skill

Perform systematic SRE audits covering security, performance, cost, and maintainability.

Audit Workflow

1. Discover - Scan codebase structure, identify key files and patterns
2. Analyze - Examine each audit area systematically
3. Report - Generate findings with severity and recommendations

Audit Areas

1. Security

Examine for vulnerabilities and unsafe patterns:

• Injection vulnerabilities: SQL injection, command injection, path traversal
• Input validation: Parameter validation, type checking, boundary enforcement
• Authentication/Authorization: Credential handling, session management, access control
• Data exposure: Sensitive data in logs, error messages, comments
• Dependency risks: Known vulnerabilities, outdated packages, supply chain

See references/security.md for detailed patterns. See references/dependencies.md for ecosystem-specific package auditing.

2. Performance

Identify efficiency issues:

• Database operations: Missing indexes, N+1 queries, unbatched operations, inefficient joins
• Memory usage: Large data structures, unbounded collections, memory leaks
• I/O patterns: Blocking operations, missing caching, redundant reads
• Algorithmic complexity: O(n²) or worse in hot paths, unnecessary iterations
• Concurrency: Lock contention, thread safety, async/await patterns

See references/performance.md for detailed patterns.

3. Cost

Assess operational expenses:

• API/service calls: Redundant calls, missing batching, rate limit risks
• Database writes: Unnecessary updates, transaction overhead, write amplification
• Compute resources: CPU-intensive operations, scaling inefficiencies
• Storage: Data retention, blob sizes, caching strategy
• Third-party services: Usage patterns, tier appropriateness

See references/cost.md for detailed patterns.

4. Maintainability

Evaluate long-term code health:

• Code quality: Duplication, complexity, naming clarity
• Error handling: Consistency, coverage, error messages
• Testing: Coverage gaps, test quality, testability
• Documentation: API docs, inline comments, README completeness
• Architecture: Coupling, cohesion, separation of concerns

See references/maintainability.md for detailed patterns.

Analysis Process

For each file/module:

1. Identify the component's purpose and criticality
2. Check each audit area relevant to the component type
3. Note findings with file location, line numbers, and evidence
4. Assess severity: Critical, High, Medium, Low
5. Provide specific remediation recommendations

Output Format

Generate a structured report:

Copy# SRE Audit Report: [Project/Component Name]

## Executive Summary
[Brief overview of audit scope and key findings]

## Critical Findings
[Issues requiring immediate attention]

## Security Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Performance Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Cost Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Maintainability Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| ...      | ...   | ...      | ...            |

## Summary Statistics
- Total findings: X
- Critical: X | High: X | Medium: X | Low: X

## Recommended Priority Actions
1. [Most urgent fix]
2. [Second priority]
3. [Third priority]

Severity Definitions

• Critical: Exploitable vulnerability or production-impacting issue; fix immediately
• High: Significant risk or degradation; fix within days
• Medium: Notable concern; address in normal development
• Low: Minor improvement; consider for technical debt backlog