product-audit

Solid

Periodic, product-wide health check — the CTO's "where do we actually stand?" Sweeps the WHOLE codebase (not a diff, not a PR) across every applicable axis — correctness, architecture, security/cybersecurity, performance, tests, UX/UI, accessibility, SEO, brand, tech debt — PLUS process & docs (incomplete phases, aging issues, solvable known-issues, doc/workflow completeness) and roadmap coherence. Mines accumulated suggestions from feature docs. Output: a severity-ranked report and concrete PROPOSALS — issues to open, roadmap features to add or remove. Every run is persisted to docs/audits/<n>-<YYYY-MM-DD>.md with an incremental audit id and findings numbered F1, F2, … so any finding is addressable later as "triage-issue <audit-id> F<k>". NEVER auto-fixes; the user decides what to act on. On Claude Code and want hand-tuned per-skill model/effort tiers? Install the `#claude` branch instead (`npx skills add gtrabanco/agentic-workflow#claude`) — see the README. This branch is model-agnostic: the skill inherits

AI & Automation 19 stars 3 forks Updated 1 weeks ago MIT

Install

View on GitHub

Quality Score: 82/100

Stars 20%
43
Recency 20%
90
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Product Audit The **CTO health check**: run every few features, before a release, or when the product is "done", to answer *"where do we actually stand, and what should we do next?"* across the entire product. **Recommend-only — it never fixes, opens issues, or edits the roadmap. It proposes; the human decides.** Its single write is its own persisted report: `docs/audits/<n>-<YYYY-MM-DD>.md`. ## Turn contract — verify before ending the turn ``` ✓ The full PRODUCT AUDIT report was printed in the fixed output format (health by dimension, F-numbered ranked findings, four proposal streams — the roadmap streams always present, `none — <why>` when empty) ✓ The report was WRITTEN to `docs/audits/<n>-<YYYY-MM-DD>.md` (incremental audit id) and committed — the file is the durable deliverable, the chat print is a copy ✓ Nothing else was fixed, filed, or changed — the report file is the ONLY mutation ✓ The closing `→ Next:` block is printed as the ABSOLUTE last output ``` About to end the turn with any box unchecked? The turn is NOT done — complete the missing box first (weak models drop end-of-document duties; this list is first on purpose). ## When to use - Periodically (every few features) or at a product-ready milestone. - When you want the broad, honest picture — quality, security, debt, docs, and roadmap — not the review of a single change (`review-change`) or PR (`audit-pr`). This is the widest lens in the workflow. `review-change` audits a diff, `audit-pr` a PR, `audi...

Details

Author
gtrabanco
Repository
gtrabanco/agentic-workflow
Created
1 months ago
Last Updated
1 weeks ago
Language
TypeScript
License
MIT

Bundled in these plugins

Similar Skills

Semantically similar based on skill content — not just same category

Code & Development Listed

audit

Use after build has produced build-report.md. Validates the build via four parallel sub-auditors (eval-replay, lint, regression, build-quality) and produces ALL-PASS verdict. Adversarial mode default-on per CLAUDE.md.

4 Updated today
mickeyyaya
Data & Documents Listed

claude-file-audit

Audit the repo's own documentation — CLAUDE.md, README.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, LICENSE, the community-health files under .github/ (issue forms, PR template, FUNDING.yml) and every committed file under .claude/ (rules, skills, launch config) — for staleness, contradictions and drift from the code, and periodically refresh the criteria from current Claude Code/harness capabilities. Use when asked to audit or review the Claude files, rules, skills, CLAUDE.md, the root docs or the GitHub issue/PR templates, to check whether the repo's own docs still match reality, or to clean up the agent-facing documentation. Produces a ranked report; files issues only with your approval.

0 Updated today
ChulioZ
Code & Development Listed

auditsmith

Use when auditing, reviewing, or assessing an application's codebase — including narrower phrasings like 'review my code', 'is this secure', 'is this production ready', 'why is this slow', 'check my error handling', 'is my LLM integration safe', 'find issues in this repo', or 'what am I missing before launch'. Covers ten areas — UX behavior, code quality, UI, security, LLM/AI usage, performance, testing, dependencies, observability, API contracts. Detects auth/authz gaps, IDOR, injection, secrets, SSRF, prompt injection, race conditions, missing error handling, empty states, N+1 queries, bundle bloat, memory leaks, flaky tests, CVEs, idempotency gaps, missing logging/alerting. Contexts — pre-launch, handover, client delivery, code review, refactor planning. Outputs findings with file:line evidence, severity ranking, and CI/lint rules to prevent regression. Stacks — React, TypeScript, Node, Python, Go, Cloudflare Workers.

1 Updated 4 days ago
opefyre