A Claude skill that turns Claude Code into your on-call senior engineer — auditing any software project, finding bugs, regressions, and risks, and fixing them surgically.
When you ask Claude Code to "audit my project", "check what's broken", or even just "it feels weird", this skill kicks in and runs a structured 5-phase sweep:
- Orient — reads
CLAUDE.md/AGENTS.md/README/ stack manifests so it never invents tables, services, or commands - Diagnose — pulls logs, greps for danger patterns, inspects DB state, checks pending migrations
- Triage — prioritized table (max 10) by severity (🔴🟠🟡🟢) and effort (S/M/L)
- Execute — auto-fixes 🔴/🟠 with S effort; asks before bigger changes
- Deliver — concise report with files touched, validation, and rollback plan
It covers 7 categories of issues, in priority order: active bugs → silent regressions → operational risks → UX inconsistencies → performance → code hygiene → test/observability gaps.
Plus a built-in security checklist (secrets, injection, AuthN/Z, CORS/CSRF, crypto, deps, PII, rate limits, file handling) and a rollback & recovery section so changes are always reversible.
Stack-agnostic by design. Tested patterns for:
| Language / Framework | Detection | Notes |
|---|---|---|
| Python | pyproject.toml, requirements.txt |
Django, Flask, FastAPI, Streamlit |
| Node / TypeScript | package.json |
Express, Next.js, NestJS |
| Go | go.mod |
|
| Rust | Cargo.toml |
|
| Java / Kotlin | pom.xml, build.gradle |
|
| Delphi / Object Pascal | *.dproj, *.dpr, uses Horse; |
Horse REST framework, FireDAC, IBX, UniDAC |
| .NET | *.csproj, *.sln |
Database engines: PostgreSQL, MySQL/MariaDB, SQLite, MSSQL, Firebird (with engine-specific gotchas: generator drift, statistics, charset mismatches, sweep interval).
Runtimes: Docker Compose, Kubernetes, systemd, PM2, Windows Services, local dev, cloud (Heroku, Fly, etc).
Linux / macOS / WSL:
git clone https://github.com/<your-username>/project-auditor.git /tmp/project-auditor
mkdir -p ~/.claude/skills/project-auditor
cp /tmp/project-auditor/project-auditor/SKILL.md ~/.claude/skills/project-auditor/Windows (PowerShell):
git clone https://github.com/<your-username>/project-auditor.git $env:TEMP\project-auditor
mkdir $env:USERPROFILE\.claude\skills\project-auditor -Force
copy $env:TEMP\project-auditor\project-auditor\SKILL.md $env:USERPROFILE\.claude\skills\project-auditor\cd /path/to/your/project
mkdir -p .claude/skills/project-auditor
cp /tmp/project-auditor/project-auditor/SKILL.md .claude/skills/project-auditor/
git add .claude/skills/project-auditor/
git commit -m "chore: add project-auditor skill"Start a new Claude Code session and ask:
what skills do you have available?
project-auditor should appear in the list.
The skill triggers on natural phrases — no special syntax needed:
- "audit the project"
- "check what's broken"
- "do a health check"
- "something feels off"
- "find bugs"
- "is everything OK?"
- "do a sweep"
- "the logs are full of errors"
It also runs well as a routine weekly pass or after every release / refactor.
You: audita o projeto
Claude: [reads CLAUDE.md, runs docker ps, pulls last 200 lines from main service]
Found 7 items. Resolving 3 now (S effort, 🔴/🟠), 2 need your approval (M),
2 are 🟡 batched for review at the end.
| # | Sev | Category | Symptom | File:line | Action | Effort |
|---|-----|-------------|----------------------------------|------------------|-----------------|--------|
| 1 | 🔴 | Active bug | NullRef on /api/orders empty list| orders.py:88 | Guard the slice | S |
| 2 | 🔴 | Sec / secrets| API key in committed .env | .env:12 | Move to secrets | S |
| 3 | 🟠 | Regression | Cookie auth broken since v2.3 | auth.py:142 | Restore HMAC | S |
...
✓ #1 — NullRef on /api/orders resolved
Files: orders.py
Change: added `if not items: return []` before slicing
Validation: pytest tests/test_orders.py → 14 passed
Rollback: git revert <sha>
Hard guardrails — built into the skill:
- ❌ No destructive ops (
DROP,TRUNCATE,rm -rf,git push --force) without explicit chat confirmation - ❌ No deleting/editing applied migrations — always fixes forward with a new one
- ❌ No exposing credentials in logs, chat, or commits
- ❌ No silencing errors to clean up output — it digs into root causes
- ❌ No inventing tables/columns/endpoints — confirms via schema first
- ❌ No rewriting whole files when a 2-line edit fixes the issue
The skill auto-detects most things, but for best results, keep a CLAUDE.md at the repo root with:
- Stack summary (languages, framework, DB)
- Critical tables/services/jobs
- Local commands (test, lint, migrate, logs)
- Conventions (timezone, language, naming)
The skill reads this first and adapts its diagnosis to your project.
PRs welcome. Useful additions:
- New stack patterns (just add to the manifest list in Phase 0)
- New DB-engine gotchas (add to the table in Phase 1)
- New language-specific danger patterns to grep for
Keep the SKILL.md under 500 lines — it's loaded into context every time the skill triggers.
MIT — see LICENSE.
Inspired by an internal auditor agent built for the BI VAIP / TAKETEC platform, generalized to work across any stack.