Code Quality Skill

Deep analysis of code quality across four domains. Works alongside code-consistency which handles surface-level triage; this skill goes deep.

Domains

Workflow

Step 1 — Scope the Analysis

Determine which domain(s) the user needs. If unspecified, do a quick scan across all four and focus on the domain(s) with the most findings.

Step 2 — Load Reference Files

Read the reference file(s) for the relevant domain(s) before analysis.

Step 3 — Analyze

Apply the domain-specific checklists and patterns from the reference files. Always consider:

• Context: Library vs application, hot path vs cold path, prototype vs production
• Language: Apply language-specific patterns where they exist
• Trade-offs: Every suggestion has a cost. Name it explicitly.

Step 4 — Report

Quick Scan Report (all four domains)

When scanning broadly, output a summary table:

| Domain        | Grade | Critical | Suggested | Notes                    |
|---------------|-------|----------|-----------|--------------------------|
| Performance   | B     | 1        | 3         | O(n²) in event loop      |
| Security      | A-    | 0        | 2         | Missing rate limiting     |
| Testability   | C     | 2        | 4         | God class, hidden deps    |
| Architecture  | B+    | 0        | 3         | Minor SRP violations      |

Then detail the critical findings. Suggested findings go in a collapsible section or follow-up if the user wants them.

Deep Dive Report (single domain)

When analyzing one domain deeply:

1. Executive summary — 2-3 sentences on overall quality
2. Critical findings — numbered, with code references and fix examples
3. Suggested improvements — grouped by impact
4. Trade-off analysis — what you'd gain and lose from each suggestion
5. Recommended next steps — prioritized action list

Grading Scale

Use +/- modifiers. Grade relative to the stated context (prototype gets more lenient grading than production code).

Severity Levels

Same as code-consistency for interoperability:

Cross-Domain Patterns

These apply across all four domains:

• Dead code: Unreachable branches, unused imports, commented-out code blocks
• Complexity: Cyclomatic complexity >10 in a single function, nesting >3 levels
• Duplication: Same logic in 3+ places without abstraction
• Naming/intent mismatch: Function name promises one thing, implementation does another
• Missing documentation: Public API without doc comments, complex algorithms without explanation, non-obvious business rules without context

Reference Files

Read before deep-diving into a domain:

• references/performance.md — Complexity analysis, memory/allocation patterns, concurrency, I/O optimization, profiling strategies
• references/security.md — OWASP patterns, injection prevention, auth/authz, secrets management, input validation, supply chain
• references/testability.md — Dependency injection, seam identification, mock strategies, coverage analysis, test pyramid, design-for-test patterns
• references/architecture.md — SOLID deep-dive, coupling metrics, layering patterns, abstraction quality, module boundaries, technical debt indicators