I have a booking platform launching next week. Three separate audits flagged dozens of potential issues across the database, API, and frontend. Security gaps, financial calculation errors, missing safeguards. The kind of list that makes you close your laptop and go for a walk.
Instead of reading each one, verifying it against the actual code, and filing issues by hand, I typed this:
/triage-bugs-team docs/aprilclaudeaudit.mdThat is a slash command I wrote the night before. One line in the terminal. What happened next took about ten minutes and zero effort from me.
The command parses the audit document, extracts every bug claim, and dispatches specialist agents to investigate each one independently. Not one generalist trying to understand everything — actual specialists. A schema agent that queries the live database to check if a missing column really is missing. A code reviewer that traces a financial calculation line by line to see if the math is actually wrong.
Each agent returns a verdict. Not “this might be a problem.” A structured judgment:
VERDICT: CONFIRMED | FALSE_POSITIVE | STALESome bugs from the audit had already been fixed in recent commits. Stale. Some were described incorrectly — the code had moved or the behavior wasn’t what the audit assumed. False positives. And some were real, verified against the live codebase, with the exact file and line number where the problem lives right now.
The confirmed ones got filed as GitHub issues automatically. Proper labels. Priority tags. Code snippets pulled from the actual current state of the repo, not the audit’s snapshot. Blast radius assessment included — what depends on this code, what breaks if it’s wrong.
Fourteen issues. Categorized. Prioritized. Ready to fix. I did not write any of them.
The part that surprised me was the false positives. Audit tools are confident. They’ll tell you a table has no security policies with absolute certainty. But code changes between when the audit runs and when you read it. The triage agents caught three bugs that had been quietly fixed in commits from two days prior. Without verification, I would have wasted time investigating problems that no longer existed.
This is not a product. It is a markdown file with instructions. The whole system is a skill prompt, maybe 300 lines, that tells the agents what to check and how to report back. It runs inside the same terminal I use for everything else.
I am six days from launch. The bug list is shrinking. And I haven’t manually filed an issue in a week.