Audits

An audit reviews code and returns findings. It does not edit code. Aura ships some audits with the project. Others are third-party skills you install for one review and do not commit. Where any audit disagrees with the always-on rules, the Aura skill, or DESIGN.md, Aura wins.

Pick an audit

Match the change in the PR to a row. Run every row that matches.

Procedure

Follow these steps for every audit.

1. Scope. Name the files or the diff under review. Default to the current branch diff against the base branch.
2. Install, third-party only. Install the one skill you need with the command on this page. Do not install a whole catalog.
3. Run. Invoke the audit with the scope. One audit per invocation.
4. Report. Return the findings in the format below. Do not edit code in the same step.
5. Apply. Apply only the findings the user accepts. Re-run the audit, or its gate command, on the touched files.
6. Clean up. Remove the third-party skill, or confirm its folder is not staged. Built-in audits stay.

Findings format

## <Audit name> — <scope>

| # | Severity | Location | Problem | Fix |
| --- | --- | --- | --- | --- |
| 1 | high | app/checkout/page.tsx:42 | Button restyled with px-6 at the call site | Use size="lg" |

**Conflicts with Aura:** <finding numbers that contradict Aura rules, the Aura skill, or DESIGN.md, and the Aura rule that wins>
**Not checked:** <what the audit could not see, for example runtime data>

Severity is high (bug, security, accessibility failure, or a broken Aura invariant), medium (visible quality or performance problem), or low (polish). Location is file:line. One finding per row. An audit with no findings says so in one line.

Audits that ship with Aura

Visual lint

@shadcn/lint checks Aura's Tailwind policy: spacing on the 13px scale, accent and gray tokens instead of a raw palette, and no restyle of a design-system component at the call site.

pnpm lint

Skill verify-aura-ui runs it, isolates findings on touched files, and fixes them against the tokens. Install and config: Lint.

SonarQube

aura blueprint adds SonarQube on every stack it can scan. It skips Rust and unknown stacks.

report writes open issues to sonar-issues.json. Turn each issue into a finding row. Docker must be running. SONAR_ADMIN_PASSWORD overrides the local admin password. .sonar-token and sonar-issues.json are git-ignored. Never print the token.

Bruno collection

Backend projects keep their HTTP API in bruno/. Run it against a local server:

cd bruno && npx @usebruno/cli run --env local

A failed assertion is a high finding. An endpoint in the diff with no .bru request is a medium finding under the Bruno rule.

gdp-ts

Proof-carrying authorization. The gate is the typechecker and the lint preset:

pnpm typecheck && pnpm lint

A sensitive function without a proof, a cast proof, or a raw id is a high finding. Practice: gdp-ts.

Third-party audits

These are not part of Aura. aura init, aura setup, and aura blueprint do not install them, and no Aura rule loads them. aura blueprint deletes the Emil and Vercel folders older Aura versions wrote into .cursor/skills/ and .agents/skills/, so a project install of those names disappears on the next blueprint. Install with -g to keep a skill in your user directory. Do not commit the installed folders.

Commands were checked against skills 1.7.4 (npx skills add --help and npx skills add <repo> --list). pnpm dlx skills add is the same CLI.

Emil Kowalski

Source: emilkowalski/skills. npx skills add emilkowalski/skills --list is the current catalog. Install only the skill the change needs:

npx skills add emilkowalski/skills --skill review-animations -a cursor -y --copy

animate, animation-vocabulary, ask-sonner, pick-ui-library, and prototype are in the same repo. Add one --skill <name> per skill.

/emil-design-eng Audita la pantalla de checkout (app/checkout/page.tsx) antes de abrir el PR.
/review-animations Revisa las animaciones de este diff contra los tokens de Aura.
/break-ui Prueba la tabla de usuarios con datos extremos y dime qué se rompe.

Motion findings are checked against the Aura motion guardrail: transform and opacity only, and reduced motion respected.

Vercel React performance

Source: vercel-labs/agent-skills. The installed name is vercel-react-best-practices. The folder in that repo is skills/react-best-practices. It checks waterfalls, bundle size, server work, re-renders, and auth plus input validation inside server actions. In an Aura app, validation stays validateFormData with an ajv JSON Schema. Do not add zod.

npx skills add vercel-labs/agent-skills --skill vercel-react-best-practices -a cursor -y --copy

/vercel-react-best-practices Haz una auditoría de rendimiento de app/dashboard y sus server actions.

WorkOS

Source: workos/skills. The workos skill covers AuthKit, SSO, Directory Sync, RBAC, widgets, and the references it routes to. On 2026-10-24, npx skills add workos/skills --list listed workos and skipped workos-widgets because its SKILL.md frontmatter does not parse.

npx skills add workos/skills --skill workos -a cursor -y --copy

/workos Revisa esta integración de AuthKit en Next.js y dime qué falta.

Blueprint does not install or delete this skill. Aura's own authorization gate is gdp-ts.

Remove a third-party skill

npx skills remove --skill review-animations -a cursor -y
npx skills remove --skill vercel-react-best-practices -a cursor -y
npx skills remove --skill workos -a cursor -y