/audit-full                          # Full audit (all modes)
/audit-full security                 # Security-focused audit
/audit-full architecture             # Architecture review
/audit-full dependencies             # Dependency audit

Opus 4.6: Uses

complexity: max

for extended thinking across entire codebases. 1M context (beta, Tier 4+) enables cross-file reasoning that chunked approaches miss.

AskUserQuestion(
  questions=[
    {
      "question": "What type of audit do you want to run?",
      "header": "Audit mode",
      "options": [
        {"label": "Full audit (Recommended)", "description": "Security + architecture + dependencies in one pass"},
        {"label": "Security audit", "description": "Cross-file vulnerability analysis, data flow tracing, OWASP mapping"},
        {"label": "Architecture review", "description": "Pattern consistency, coupling analysis, dependency violations"},
        {"label": "Dependency audit", "description": "License compliance, CVE checking, version currency"}
      ],
      "multiSelect": false
    },
    {
      "question": "What should be audited?",
      "header": "Scope",
      "options": [
        {"label": "Entire codebase", "description": "Load all source files into context"},
        {"label": "Specific directory", "description": "Focus on a subdirectory (e.g., src/api/)"},
        {"label": "Changed files only", "description": "Audit only files changed vs main branch"}
      ],
      "multiSelect": false
    }
  ]
)

• Full audit: All 3 domains, maximum context usage
• Security only: Focus token budget on source + config files
• Architecture only: Focus on module boundaries, imports, interfaces
• Dependency only: Focus on lock files, manifests, import maps
• Changed files only: Use

  git diff --name-only main...HEAD

  to scope

• node_modules/

  ,

  vendor/

  ,

  .venv/

  ,

  __pycache__/

• dist/

  ,

  build/

  ,

  .next/

  ,

  out/

• *.min.js

  ,

  *.map

  ,

  *.lock

  (read lock files separately for deps audit)
• Binary files, images, fonts
• Test fixtures and snapshots (unless auditing tests)
• Generated files (protobuf, graphql codegen)

1. Priority loading: Entry points first, then imported modules
2. Directory scoping: Ask user to narrow to specific directories
3. Fallback: Recommend

   /ork:verify

   for chunked multi-agent approach

undefined

1. Glob all source files matching inclusion patterns
2. Sort by priority: entry points → core modules → utilities → config
3. Read files in parallel using multiple Read tool calls per message
4. Track loaded tokens to stay within budget

references/security-audit-guide.md

1. Data flow tracing: Track user input from entry point → processing → storage
2. Auth boundary verification: Ensure all protected routes check auth
3. Secret detection: Scan for hardcoded credentials, API keys, tokens
4. Injection surfaces: SQL, command, template injection across file boundaries
5. OWASP Top 10 mapping: Classify findings by OWASP category

references/architecture-review-guide.md

1. Dependency direction: Verify imports flow inward (clean architecture)
2. Circular dependencies: Detect import cycles across modules
3. Layer violations: Business logic in controllers, DB in routes, etc.
4. Pattern consistency: Same problem solved differently across codebase
5. Coupling analysis: Count cross-module imports, identify tight coupling

references/dependency-audit-guide.md

1. Known CVEs: Check versions against known vulnerabilities
2. License compliance: Identify copyleft licenses in proprietary code
3. Version currency: Flag significantly outdated dependencies
4. Transitive risk: Identify deep dependency chains
5. Unused dependencies: Detect installed but never imported packages

• CRITICAL: {n} (must fix before deploy)
• HIGH: {n} (fix within sprint)
• MEDIUM: {n} (fix within quarter)
• LOW: {n} (track and address)

• security-scanning

  — Automated scanner integration (npm audit, Semgrep, etc.)

• defense-in-depth

  — 8-layer security architecture patterns

• owasp-top-10

  — OWASP vulnerability classification

• clean-architecture

  — Architectural pattern reference

• quality-gates

  — Quality assessment criteria

• verify

  — Chunked multi-agent verification (fallback for large codebases)

• Security Audit Guide — Cross-file vulnerability patterns
• Architecture Review Guide — Pattern and coupling analysis
• Dependency Audit Guide — CVE, license, currency checks
• Token Estimation — File type ratios and budget planning
• Audit Report Template — Structured output format
• Severity Matrix — Finding classification criteria
• Audit Completion Checklist — Pre-report verification
• Token Estimation Script — Automated LOC → token estimation