09-ai-generated-project-triage

name	09-ai-generated-project-triage
description	Use as the first pass on inherited, vibe-coded, Lovable/Bolt/Cursor/Claude/Codex-generated projects. Builds a factual repo map, identifies catastrophic risks, and creates an ordered stabilization plan before large refactors.

AI-Generated Project Triage

Mission

Take a chaotic or inherited AI-generated project and turn it into a factual, controllable stabilization plan. Do not start refactoring blindly. First map what exists, what is broken, what is dangerous, and what must be fixed in order.

Use when

• The user says the project is vibe-coded, messy, generated by Lovable/Bolt/Cursor/v0/Claude/Codex, or inherited from a non-engineer.
• The user wants to professionalize, secure, stabilize, document, or prepare a project for client delivery.

Triage principles

1. Facts before fixes.
2. Snapshot before edits.
3. Catastrophic risk before polish.
4. Small reversible changes before rewrites.
5. Evidence before opinion.

Workflow

1. Snapshot current state

git status --short
git branch --show-current
git log --oneline -5 || true
find . -maxdepth 3 -type f | sed 's#^./##' | sort | head -250

If Git is missing, recommend initializing it before any changes.

2. Detect stack and entry points

find . -maxdepth 2 -type f \( -name 'package.json' -o -name 'requirements.txt' -o -name 'pyproject.toml' -o -name 'pnpm-lock.yaml' -o -name 'bun.lockb' -o -name 'yarn.lock' -o -name 'Dockerfile' \) -print
cat package.json 2>/dev/null | sed -n '1,220p'

Record:

• framework,
• package manager,
• deploy platform,
• auth provider,
• DB provider,
• external services,
• test/build scripts.

3. Search for catastrophic risks first

rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' --glob '!.git' \
  'NEXT_PUBLIC_|VITE_|REACT_APP_|SUPABASE_SERVICE_ROLE|OPENAI_API_KEY|ANTHROPIC_API_KEY|STRIPE_SECRET|DATABASE_URL|BEGIN PRIVATE KEY|sk-[A-Za-z0-9]|localStorage|sessionStorage|service_role|select\(\*\)|DROP TABLE|DROP COLUMN' .

Prioritize:

• exposed secrets;
• auth bypass;
• public database access;
• destructive migrations;
• no backups;
• paid endpoints without rate limits;
• production data mixed with dev/staging.

4. Run safe validation

Run available commands if reasonable:

npm run lint || true
npm run type-check || true
npm test || true
npm run build || true

Do not spend hours fixing dependency chaos before identifying P0 risks.

5. Produce system map

Document:

• route map;
• data model map;
• auth flow;
• external service map;
• deployment flow;
• known environments;
• known missing pieces.

6. Create stabilization roadmap

Use this sequence:

1. Stop data/secret/billing bleeding.
2. Establish Git safety and backup/rollback.
3. Fix auth/authz and RLS/tenant isolation.
4. Add validation/rate limits/timeouts.
5. Add production monitoring and error tracking.
6. Fix performance bottlenecks that affect user experience.
7. Add tests around critical flows.
8. Document operations and handoff.
9. Only then refactor UI/architecture.

Output contract

# AI-Generated Project Triage

## Repository snapshot

## Stack map

## Catastrophic-risk scan
| Severity | Evidence | Risk | Immediate action |
|---|---|---|---|

## System map

## What appears safe

## What is unknown

## Stabilization roadmap
| Phase | Goal | Tasks | Verification |
|---|---|---|---|

## Suggested next skill

Stop criteria

Stop before major refactors if Git is dirty, no backup exists, or P0 risks are present. Stabilize first.