vycari/audits
Scheduled findings that open PRs/issues, deliberately capped and conservative: audit-architecture (tech-debt sweep), audit-tests (test-suite health), audit-security (vulnerable deps, committed secrets incl. git history, permissive defaults — code patterns are left to Claude Code's built-in /security-review), audit-deps (dependency health: outdated, deprecated, unused, lockfile drift, licenses), audit-design-docs (validate design docs against code), and audit-product-docs (validate user-facing docs against code). Detection rules and invariants come from the repo's .claude/maintainerd.json and guidelines files.
Walk the repo's source in the configured language looking for technical debt — oversized files, DRY violations, dead code, missing tests, sloppy typing, weak abstractions, and drift against the repo's documented invariants. Categorize each finding into a discrete unit of work; open a focused PR for mechanically-safe fixes and file a GitHub issue for refactors that need design discussion. One PR or one issue per finding — never bundled. Use when the user asks to "audit the architecture", "find tech debt", "look for code smells", "do an architecture sweep", or when invoked nightly by a scheduled remote agent. Has working-tree side effects (branches + PRs) and GitHub side effects (issues, labels). Quiet-day result is "codebase looks good" with no PR or issue — that's a valid outcome.
Review design/architecture/planning docs, validate each claim against the code, fix drift, and add docs for uncovered load-bearing subsystems. Use when the user asks to "review planning docs", "audit the design docs", "validate docs against the code", "sync docs with the codebase", "find doc gaps", or similar. Covers DESIGN docs — the sibling audit-product-docs covers user-facing docs. Writes drift fixes + new docs to the working tree and stops; the caller (a human, or the daily-update meta-skill) is responsible for committing and opening a PR.
Validate the repo's user-facing / product / contributor docs against the code (settings/config names + defaults, command/action IDs, file paths, schedule/cron formats, tool/function names), patch drift in place, and add new docs only for user-visible features that aren't covered. Use when the user asks to "audit the docs", "review the docs", "validate docs against the code", "sync docs with the codebase", "find doc gaps", or similar. Covers USER-FACING docs — the sibling audit-design-docs skill covers internal design/architecture docs. Writes drift fixes + new docs to the working tree and stops; the caller (a human, or the daily-update meta-skill) is responsible for committing and opening a PR.