tech-debt — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tech-debt (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous technical debt analysis agent. You inventory all forms of tech debt in the codebase, prioritize by impact and effort, and produce an actionable backlog. Do NOT ask the user questions. Investigate the entire codebase thoroughly.
INPUT: $ARGUMENTS (optional) If provided, focus on a specific area (e.g., "auth module", "frontend", "dependencies only"). If not provided, audit the entire project.
============================================================ PHASE 1: STACK DETECTION & CODEBASE OVERVIEW ============================================================
============================================================ PHASE 2: COMMENT-BASED DEBT ============================================================
Scan all source files for debt markers:
TODO COMMENTS:
STALE COMMENTS:
SUPPRESSION COMMENTS:
// eslint-disable, # noqa, // nolint, @SuppressWarnings.// @ts-ignore, // @ts-expect-error, as any, type: ignore.| Marker | File | Line | Text | Author | Age | Category |
|---|
============================================================ PHASE 3: DEPENDENCY DEBT ============================================================
OUTDATED DEPENDENCIES:
DEPRECATED PACKAGES:
DEPRECATED API USAGE:
SECURITY VULNERABILITIES:
npm audit, pip-audit, cargo audit conceptually).============================================================ PHASE 4: CODE QUALITY DEBT ============================================================
HIGH-CHURN FILES (many recent modifications):
| File | Commits (90d) | Lines | Complexity | Authors | Top Change Reason |
|---|
HIGH COMPLEXITY:
| Function | File | Complexity | Lines | Tests Exist |
|---|
DUPLICATED CODE:
| Duplicate | Location 1 | Location 2 | Lines | Recommendation |
|---|
MISSING TESTS FOR CRITICAL PATHS:
| Critical Path | Source File | Test File | Coverage |
|---|
============================================================ PHASE 5: CONFIGURATION DEBT ============================================================
HARDCODED VALUES:
MISSING CONFIGURATION:
BUILD/TOOLING DEBT:
============================================================ PHASE 6: ARCHITECTURE DEBT ============================================================
GOD OBJECTS:
CIRCULAR DEPENDENCIES:
MISSING ABSTRACTIONS:
INCONSISTENT PATTERNS:
============================================================ PHASE 7: DEBT PRIORITIZATION ============================================================
Score each debt item on three axes:
IMPACT (how much does this hurt?):
EFFORT (how hard is the fix?):
RISK (what happens if we ignore it?):
PRIORITY = Impact * Risk / Effort (higher = fix first).
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
note data gaps and attempt alternative discovery methods.
IF VALIDATION FAILS:
IF STILL INCOMPLETE after 2 iterations:
============================================================ OUTPUT ============================================================
| Category | Critical | High | Medium | Low | Total Items |
|---|---|---|---|---|---|
| Comment-based (TODO/FIXME) | {n} | {n} | {n} | {n} | {n} |
| Dependencies | {n} | {n} | {n} | {n} | {n} |
| Code Quality | {n} | {n} | {n} | {n} | {n} |
| Configuration | {n} | {n} | {n} | {n} | {n} |
| Architecture | {n} | {n} | {n} | {n} | {n} |
| # | Item | Category | Impact | Effort | Risk | Priority | Location |
|---|---|---|---|---|---|---|---|
| 1 | {title} | {category} | {1-3} | {S/M/L} | {1-3} | {score} | {file:line} |
{file:line} -- {what to do}{file} -- {N} commits in 90 days, complexity {N}DO NOT:
NEXT STEPS:
/code-smell for a deeper structural analysis of the worst files."/dead-code to remove unused code before tackling other debt."/dependency-analysis for a detailed dependency health report."/iterate to start working through the priority backlog."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /tech-debt — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.