| name | dev-ponytail-audit |
| description | Repo-wide over-engineering scan — the whole tree instead of a diff, ranked by what to delete, simplify, or replace with a stdlib/native equivalent. Use on "audit this codebase", "audit for over-engineering", "what can I delete from this repo", "find the bloat", "where is this over-built". Reports; applies nothing. |
dev-ponytail-review, repo-wide. Same tags, same one-line format, ranked biggest
cut first.
Delivery Mode (lite | full | ultra, default lite)
Mode is the trailing argument when it is exactly lite, full, or ultra; everything else is the task/feature description. No mode given → lite.
lite (default) — the ten biggest cuts, inline. Dependencies and the largest files first; that's where the mass is.full — whole tree, every finding, ranked. Writes docs/<feature-name>/AUDIT.md.ultra — full fanned out: one read-only sub-agent per top-level module in parallel (dev-researcher when available, else general-purpose), each returning the format below. Merge, de-duplicate, rank, write the same file.
<feature-name> is the audited scope — the module named in the invocation, or
repo for a whole-tree pass.
Artifact Location
Artifact paths below are relative to the artifact root: docs/ by default, or wherever the user (or
dev-loop, which passes the one it resolved) points it. A gitignored or out-of-repo root means the
artifacts are scratch — write and read them as normal, but never commit them.
Scope
Skip what isn't yours to cut: node_modules, vendor, build output, generated
code, lockfiles, migrations, anything .gitignored. Vendored code is someone
else's repo, not your over-engineering.
Hunt
In order of payoff:
- Dependencies the stdlib or platform ships — one
package.json/requirements.txt/go.mod read finds more mass than an hour of file reading.
- Single-implementation abstractions — interfaces, ABCs, factories with one product.
- Wrappers that only delegate.
- Dead config and flags — nothing reads it, or one value at every call site.
- Hand-rolled stdlib — a written-out
groupby, zip, dedent, date math.
- One-export files nothing imports.
Grep for callers before writing a finding. "Nothing uses this" is the claim most
often wrong in an audit, and a confident wrong deletion is this skill's one
expensive mistake — dynamic dispatch, reflection, DI containers, and test-only
usage all hide callers. Can't confirm → tag the line unverified:.
Output
Ranked, one line per finding:
<tag> <what to cut>. <replacement>. [path:line]
Tags are dev-ponytail-review's: delete:, stdlib:, native:, yagni:,
shrink:. End with net: -<N> lines, -<M> deps possible. Nothing to cut →
Lean already. Ship.
Boundaries
Complexity only — correctness and security go to dev-code-review, performance
to dev-perf. Applies nothing in any mode: a repo-wide automated deletion pass
is exactly the confident-wrong change dev-ponytail warns about. To act, hand
the audit to dev-create-plan or fix the top items by hand.
