CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

audit-codebase

Codebase health audit scoring 7 categories with progression plan

55

Quality

69%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./examples/skills/audit-codebase/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, well-structured, highly actionable audit playbook: every category pairs copy-paste scan commands with explicit scoring anchors, and the report format and weighted formula leave nothing ambiguous. Its main weaknesses are technical defects in several commands (brace-glob includes, missing -P flag, a shell precedence bug) and small redundancies, which keep it just below top marks.

Suggestions

Fix the non-functional grep include patterns: replace --include="*.{js,ts,py,...}" with repeated --include flags (e.g. --include='*.js' --include='*.ts'), since glob patterns do not expand braces and these scans currently match no files.

Use grep -P (or a portable [Aa][Pp][Ii]-style pattern) for the '(?i)' case-insensitive group in the Secrets scan, and parenthesize the shell precedence bug on the pyflakes line: [ -f pyproject.toml ] || [ -f setup.py ] currently short-circuits incorrectly.

Condense the three near-identical tier tables into one format definition plus per-tier focus descriptions to trim ~20 lines of repeated scaffolding.

DimensionReasoningScore

Conciseness

The body is command-first with scoring anchors and a concrete output template, and it does not explain concepts Claude already knows. Minor padding exists — the three tier tables repeat identical headers/columns verbatim and could be condensed to one format note — fitting anchor 4 (efficient with minor trimmable instances) rather than the every-token-earns-its-place level 5.

4 / 5

Actionability

Guidance is concrete and mostly copy-paste ready: full bash scans, per-category scoring anchors, a weighted formula, and an exact report template. However, several flagship commands have executable defects — grep --include="*.{js,ts,...}" brace patterns match no real files, the PCRE '(?i)' group is used without -P under -E, and line 197 has a shell &&/|| precedence bug — so it is anchor 4 (mostly executable with minor gaps) rather than fully-executable level 5.

4 / 5

Workflow Clarity

The sequence is clear and consistently applied: run each category's scan, score against the anchors, compute the weighted overall, and emit the tiered progression plan. All operations are read-only so the destructive/batch validation cap does not apply, but there are no checkpoints for handling tool failures (missing jq, npx downloads, absent lockfiles beyond the noted check), keeping it at anchor 4 rather than the explicit-validation level 5.

4 / 5

Progressive Disclosure

There are no bundle files, and the single 330-line SKILL.md is uniformly structured with one section per category, a scoring/report section, and sources. All content is consumed in a single audit pass, so the single-file layout is defensible; the only candidate for extraction is the ~70-line report template. This fits anchor 4 (good structure, appropriately placed content, minor organization gaps) better than anchor 3, whose example is unstructured inline content that clearly belongs elsewhere.

4 / 5

Total

16

/

20

Passed

Description

50%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description communicates a clear, concrete offering but stops at the midpoint on every dimension: it names the domain and two actions without enumerating the categories, has no "Use when" trigger clause, and has more than minor overlap risk with code-review and security-audit skills. Adding explicit trigger phrasing and natural synonyms would lift most dimensions by a full level.

Suggestions

Add an explicit trigger clause, e.g. "Use when the user asks for a codebase health check, code quality audit, or a score/progression plan for a project."

Name the 7 categories (secrets, security, dependencies, structure, tests, imports, AI patterns) or at least 3-4 of them so the "what" is comprehensive rather than minimal.

Include natural synonyms users would say ("code quality", "tech debt", "health check", "project audit") to improve trigger-term coverage and distinctiveness.

DimensionReasoningScore

Specificity

Names the domain ("Codebase health audit") and exactly two concrete actions ("scoring 7 categories", "progression plan"), matching the anchor for 1-2 concrete actions without comprehensive coverage. It does not name the categories or several specific actions, so it is not level 4; it is well above the generic level 2 because the domain and actions are explicit.

3 / 5

Completeness

The "what" is clear (score 7 health categories, produce a progression plan) but there is no "Use when..." clause or equivalent explicit trigger guidance, which per the judging guidelines caps completeness at 3. It cannot be level 4 (which requires both what and when) and is above level 2 because the "what" is concrete rather than vague.

3 / 5

Trigger Term Quality

Contains relevant keywords a user might say ("codebase", "health audit", "scoring") but misses common natural variations such as "code quality", "tech debt", "health check", or "project audit". Keyword coverage is present but incomplete, fitting anchor 3 rather than the comprehensive synonym coverage of level 5 or the sparse coverage of level 2.

3 / 5

Distinctiveness Conflict Risk

"Codebase health audit" is somewhat specific and the "7 categories with progression plan" framing helps, but it still overlaps with general code-review, security-review, and project-init skills that a user might trigger with similar phrasing like "review my codebase". This fits anchor 3 (somewhat specific but could still overlap with similar skills) better than anchor 4's minor-overlap bar.

3 / 5

Total

12

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

FlorianBruniaux/claude-code-ultimate-guide

Path

examples/skills/audit-codebase/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.