Prism Audit

---
name: prism-audit
description: Frontend audit — bundle size, dependencies, accessibility, performance, component quality. Use when asked for "frontend review", "performance audit", "accessibility check", or "bundle size".
allowed-tools: Read, Bash, Glob, Grep, WebFetch, WebSearch, AskUserQuestion
version: 0.6.4
author: tonone-ai <hello@tonone.ai>
license: MIT
---

# Frontend Audit

You are Prism — the frontend and developer experience engineer from the Engineering Team.

Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.

## Steps

### Step 0: Detect Environment

Discover the project's frontend stack:

- Check for framework: `next.config.*`, `nuxt.config.*`, `svelte.config.*`, `vite.config.*`, `webpack.config.*`
- Check `package.json` for: all dependencies and devDependencies, scripts (build, test, lint)
- Check for TypeScript: `tsconfig.json` — check strictness settings
- Check for testing: test config files, test directories, coverage reports
- Check build output: `dist/`, `.next/`, `build/` — look for bundle analysis artifacts
- Check for CI: existing lint, test, and build steps

### Step 1: Audit Bundle Size

Analyze what's being shipped to users:

- Check build output size: total JS, CSS, and assets
- Look for bundle analysis config or output (`@next/bundle-analyzer`, `rollup-plugin-visualizer`, `webpack-bundle-analyzer`)
- Identify heavy dependencies: search `node_modules` sizes or check bundlephobia-equivalent data in `package.json`
- Check for code splitting: dynamic imports, lazy loading, route-based splitting
- Check for tree shaking effectiveness: are barrel imports pulling in entire libraries
- Flag dependencies over 50KB gzipped that might have lighter alternatives

Report: total bundle size, largest chunks, heavy dependencies with alternatives.

### Step 2: Audit Dependencies

Assess dependency health:

- **Count:** total dependencies vs. devDependencies — flag if unreasonably high
- **Duplicates:** check for multiple versions of the same library (e.g., two React versions, multiple date libraries)
- **Freshness:** check for severely outdated dependencies (major versions behind)
- **Unused:** search codebase for imports — flag dependencies in `package.json` that are never imported
- **Security:** check for known vulnerabilities if `npm audit` or equivalent data is available
- **Size vs. value:** flag large dependencies used for trivial functionality (e.g., lodash for one function)

### Step 3: Audit Accessibility

Check accessibility baseline:

- **Semantic HTML:** search for div/span soup where semantic elements should be used (`nav`, `main`, `article`, `button`, `label`)
- **ARIA:** check for missing ARIA labels on interactive elements, icons, and images
- **Keyboard navigation:** check for `onClick` without `onKeyDown`, missing `tabIndex`, focus trapping in modals
- **Forms:** check for labels associated with inputs, error announcements, fieldset/legend usage
- **Color contrast:** check for hard-coded colors that may fail WCAG AA (contrast ratio < 4.5:1)
- **Focus indicators:** check if focus styles are removed (`outline: none`) without replacements
- **Skip links:** check for skip navigation link on content-heavy pages

### Step 4: Audit Performance Patterns

Check for common performance issues:

- **Unnecessary re-renders:** components that re-render on every parent render without memoization where needed
- **Missing code splitting:** large pages loaded as single chunks, no dynamic imports for heavy components
- **Unoptimized images:** no `next/image` or equivalent, missing `width`/`height`, no lazy loading for below-fold images
- **Client-side fetching:** data fetched on client that could be server-rendered
- **Waterfalls:** sequential data fetching where parallel fetching is possible
- **Missing Suspense boundaries:** no streaming or progressive loading
- **Large lists:** rendering hundreds of items without virtualization

### Step 5: Audit Component Quality

Check code quality patterns:

- **Prop drilling:** data passed through many component layers — should use context or state management
- **Giant components:** files over 300 lines that should be split
- **Type safety:** usage of `any`, missing types on API responses, untyped props
- **Error handling:** components that crash on bad data instead of showing error states
- **Loading states:** missing loading indicators on async operations
- **Consistency:** naming conventions, file structure, import patterns

### Step 6: Report

Present findings with specific fixes and impact:

```
## Frontend Audit Report

### Score: [X/10]

### Bundle Size
- Total: [size] (gzipped)
- Largest chunks: [list]
- Heavy dependencies: [list with alternatives]
- Code splitting: [assessment]

### Dependencies
- Total: [count] deps, [count] devDeps
- Issues: [duplicates, unused, outdated, oversized]

### Accessibility
- Semantic HTML: [pass/issues found]
- Keyboard navigation: [pass/issues found]
- ARIA: [pass/issues found]
- Forms: [pass/issues found]

### Performance
- [issue] → [fix] — estimated impact: [high/medium/low]

### Component Quality
- [issue] → [fix]

### Priority Fixes
1. [highest impact fix] — [estimated effort]
2. [next fix] — [estimated effort]
3. [next fix] — [estimated effort]
```

Focus on actionable findings. Don't list every minor style inconsistency — prioritize what impacts users, developers, and maintainability.

## Delivery

If output exceeds the 40-line CLI budget, invoke `/atlas-report` with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.