analyzelisted

# Analyze Skill When this skill activates, IMMEDIATELY invoke the script. The script IS the workflow. Do NOT explore the codebase first. ## Triggers - `analyze this codebase` - architecture and quality focus - `review code quality` - quality focus - `run security assessment` - security focus - `architecture review of this system` - architecture focus - `find code smells` - quality focus ## Quick Reference | Input | Focus | Minimum Steps | |-------|-------|---------------| | Architecture review | Structure, dependencies, layering | 6 | | Security assessment | Input validation, auth, data handling | 7-9 | | Code quality | Duplication, complexity, test gaps | 6-7 | | Broad investigation | All dimensions | 9-12 | --- ## Security When using the `Bash` tool, all arguments containing variable or user-provided input **MUST** be quoted to prevent command injection vulnerabilities. Refer to the repository style guide on Command Injection Prevention (CWE-78). **WRONG**: `grep $PATTERN /some/path` **CORRECT**: `grep -- "$PATTERN" /some/path` `--thoughts` carries the user's request description and, at later steps, accumulated findings: both are request-derived text. Double quotes alone do not neutralize this argument: `$(...)` and backticks inside a double-quoted `--thoughts "..."` string still execute before the script ever receives the value, because the Bash tool expands them first. A heredoc does not close this gap either: a request line that reads `EOF` on its own terminate