Tech Debt Auditor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tech Debt Auditor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill directs the agent to systematically scan a codebase for technical debt, categorize every item by type, and then rank each item against an effort/impact matrix so you can prioritize what to tackle first. It distinguishes between cosmetic debt (naming, formatting), structural debt (tangled dependencies, god classes), and strategic debt (shortcuts taken deliberately). The output is a prioritized backlog, not just a complaint list.
Use this when you're planning a refactoring sprint, preparing for a new feature that will touch old code, or doing a code quality review before onboarding new engineers.
Copy this file to .agents/skills/tech-debt-auditor/SKILL.md in your project root.
Then ask:
Point to a specific directory, a single file, or ask for a whole-repo scan. For large repos, start with the highest-churn directories.
Add the instructions below to your .cursorrules or paste them into the Cursor AI pane before pointing to the code you want audited.
Paste the file or directory listing into the chat along with the instructions from the section below. For large codebases, provide the directory tree and the agent will ask for specific files it needs to inspect.
When asked to audit for technical debt, follow this process precisely:
Read the target files thoroughly. For each file, look for:
Structural debt
Dependency debt
Test debt
Documentation debt
Cosmetic debt
For every debt item found, assign:
Categorize each item:
Format the output as follows:
## Tech Debt Audit — [Target]
### Summary
- Total items found: N
- Do First: N items
- Plan In: N items
- Nice to Have: N items
- Deprioritize: N items
### Do First (High Impact, Low Effort)
| # | File | Debt Type | Description | Impact | Effort |
|---|------|-----------|-------------|--------|--------|
| 1 | `src/foo.ts` | Structural | Function `processOrder` is 120 lines and handles 4 unrelated concerns | 3 | 1 |
### Plan In (High Impact, High Effort)
[Same table format]
### Nice to Have
[Same table format]
### Deprioritize
[Same table format]
### Recommended Starting Point
[2–3 sentences explaining which item(s) to tackle first and why, including any dependencies between items]Do not suggest fixes in detail — this is an audit, not a refactor plan. If the user wants a fix plan for a specific item, they should use the Refactor Planner skill.
Input to Agent:
"Use the Tech Debt Auditor skill on src/billing/."Output from Agent:
## Tech Debt Audit — src/billing/>
### Summary - Total items found: 9 - Do First: 3 items - Plan In: 2 items - Nice to Have: 3 items - Deprioritize: 1 item
>
### Do First (High Impact, Low Effort)
>
| # | File | Debt Type | Description | Impact | Effort | |---|------|-----------|-------------|--------|--------| | 1 |invoiceService.ts| Structural | Stripe API key hardcoded on line 12 instead of read from env | 3 | 1 | | 2 |invoiceService.ts| Test |generateInvoice()has zero test coverage — it's the most critical billing path | 3 | 2 | | 3 |utils/format.ts| Documentation | 6 exported functions have no JSDoc; used across 11 files | 2 | 1 |
>
### Plan In (High Impact, High Effort)
>
| # | File | Debt Type | Description | Impact | Effort | |---|------|-----------|-------------|--------|--------| | 4 |billingController.ts| Structural | 280-line god class handles HTTP parsing, business logic, and DB writes with no separation | 3 | 3 | | 5 |billingController.ts| Dependency | Directly importsdbconnection instead of going through a repository layer, making testing impossible | 3 | 3 |
>
### Recommended Starting Point Fix the hardcoded API key immediately (item 1) — it's a security issue, not just tech debt. Then add tests for generateInvoice() (item 2) before touching anything else, so you have a safety net when splitting the god class (item 4).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.