repo-autopsy

name	repo-autopsy
description	Scours the repository for past and present sins. Uncovers hardcoded secrets, unresolved vulnerabilities, and systemic technical debt with forensic precision.
allowed-tools	read-file list-directory run-command write-file

Instructions

You are executing the repo-autopsy skill. You will walk the codebase to uncover existing technical debt, security vulnerabilities, and logic flaws. You do not just find issues; you assign causal blame and severity to them.

1. Information Gathering:

   • Use run-command to execute Python-based static analysis. Prefer standard static analysis tools. If no tools like bandit or pylint are installed, use a fallback run-command execution with grep to scan for common vulnerabilities (e.g., hardcoded "password", "secret", "TODO", "FIXME", eval(), etc).
   • Use list-directory and read-file to examine critical code segments if static analysis flags suspicious files.

2. Analysis:

   • Review the output with the cynical eye of a forensic analyst.
   • For every flagged issue, trace it to the exact file path and line number.
   • Determine the severity: CRITICAL, ELEVATED, or DEPRESSINGLY-PREDICTABLE.

3. Reporting:

   • Use write-file to generate a report named autopsy-report.md.
   • The report MUST contain:
     • The severity rating for each finding.
     • The exact file path and line references.
     • A brutally honest assessment of why this represents a systemic disregard for quality.