Technical Debt Diagnostic Analyzer

Problem

Large codebases accumulate code smells, architecture decay, dependency risks, and security hazards at the same time. These issues rarely fail in one obvious way; they make refactoring slower, increase review cost, and complicate security patching. This skill turns scattered signals into a traceable diagnostic report instead of generic advice.

How It Works

The skill follows a fixed workflow:

• It confirms language, scan granularity, and focus area for a file, module, or repository.
• It statically checks code for long functions, duplicate code, god classes, and deep nesting, with file locations or snippets where possible.
• It inspects module boundaries and layering for circular dependencies, layer violations, and bloated files.
• It scans manifests such as package.json, requirements.txt, and pom.xml for stale locked versions, deprecated packages, unused dependencies, and version conflicts.
• It flags common risk patterns related to SQL injection, hardcoded credentials, unsafe deserialization, and sensitive logging, with a “needs manual review” note.
• It ranks findings by severity, fix cost, and impact, then produces a Sprint-level repayment roadmap.

Boundaries

The skill is best for static diagnosis and prioritization, not for executing user code or replacing a full SCA/security audit. Dependency findings rely on known CVE data and manifest files, so teams should still verify impact with tools like Snyk or OWASP Dependency Check. For repositories over 10,000 lines, module-by-module analysis is preferable.