Skip to content

vycari/audits

v0.3.1MIT

Scheduled findings that open PRs/issues, deliberately capped and conservative: audit-architecture (tech-debt sweep), audit-tests (test-suite health), audit-security (vulnerable deps, committed secrets incl. git history, permissive defaults — code patterns are left to Claude Code's built-in /security-review), audit-deps (dependency health: outdated, deprecated, unused, lockfile drift, licenses), audit-design-docs (validate design docs against code), and audit-product-docs (validate user-facing docs against code). Detection rules and invariants come from the repo's .claude/maintainerd.json and guidelines files.

audits

Six scheduled sweeps that find work and file it as discrete units — one PR or one issue per finding, never bundled. Built to run unattended several times a day, which is why they are deliberately capped, strict about dedup, and silent on clean: a run that finds nothing produces no PR, no issue, and no report. Absence is the signal.

Skills

SkillWhat it doesTypical trigger
audit-architectureNightly tech-debt sweep of the source: oversized modules, DRY/typing problems, dead exports, and drift from the repo's own invariants.md.scheduled
audit-testsTest-suite health: coverage gaps on tested modules, decorative mocks, weak assertions, brittle strategy, rotting skips.scheduled
audit-securityWhole-tree + dependency + git-history sweep: CVEs, committed secrets, permissive defaults. Complements /security-review, which owns code patterns in the pending diff.scheduled
audit-depsDependency health — outdated, deprecated, unused, phantom, lockfile drift, licenses. Vulnerabilities belong to audit-security.scheduled
audit-design-docsCheck design/planning docs still describe the code as built.scheduled
audit-product-docsCheck user-facing and contributor docs still match the code.scheduled

Two properties worth knowing before you schedule these

Honest about coverage. A category whose scanner isn't installed is reported "not scanned", never "clean". A green audit has to mean "we looked", not "we couldn't look".

Pattern promotion. When the same specific problem gets fixed repeatedly, the guideline-checking audits stop re-fixing it and file one human-gated issue proposing it become a rule in config.guidelines — or, if the rule already exists and keeps being violated, a mechanical guard. The mechanism is in references/pattern-promotion.md.

Configuration

Every skill here reads the repo's config contract — .claude/maintainerd.json plus .claude/guidelines/*.md, checked into the consuming repo. Run /bootstrap (from maintainerd-core) to generate it. The canonical schema ships with this plugin at references/config-schema.md.

Skills that read text authored outside the repo follow the shared contract in references/untrusted-input.md; scheduled skills note which model tier they want in references/model-tiers.md.

Install

/plugin marketplace add Vycari/maintainerd
/plugin install audits@maintainerd

Source and issues: https://github.com/Vycari/maintainerd