Initial commit

skills/codebase-auditor/examples/remediation_plan.md

@@ -0,0 +1,126 @@
+# Codebase Remediation Plan
+
+**Generated**: 2024-10-21 14:30:00
+**Codebase**: `/Users/connor/projects/example-app`
+
+---
+
+## Priority 0: Critical Issues (Fix Immediately ⚡)
+
+**Timeline**: Within 24 hours
+**Impact**: Security vulnerabilities, production-breaking bugs, data loss risks
+
+### 1. Potential API key found in code
+**Category**: Security
+**Location**: `src/utils/api.ts`
+**Effort**: LOW
+
+**Issue**: Found potential secret on line 12
+
+**Impact**: Exposed secrets can lead to unauthorized access and data breaches
+
+**Action**: Remove secret from code and use environment variables or secret management tools
+
+---
+
+### 2. Use of eval() is dangerous
+**Category**: Security
+**Location**: `src/legacy/parser.js`
+**Effort**: MEDIUM
+
+**Issue**: Found on line 45
+
+**Impact**: eval() can execute arbitrary code and is a security risk
+
+**Action**: Refactor to avoid eval(), use safer alternatives like Function constructor with specific scope
+
+---
+
+## Priority 1: High Issues (Fix This Sprint 📅)
+
+**Timeline**: Within current sprint (2 weeks)
+**Impact**: Significant quality, security, or user experience issues
+
+### 1. High cyclomatic complexity (28)
+**Category**: Code Quality
+**Effort**: HIGH
+
+**Action**: Refactor into smaller functions, extract complex conditions
+
+### 2. Line coverage below target (65.3%)
+**Category**: Testing
+**Effort**: HIGH
+
+**Action**: Add tests to increase coverage by 14.7%
+
+### 3. Long function (127 lines)
+**Category**: Code Quality
+**Effort**: MEDIUM
+
+**Action**: Extract smaller functions for distinct responsibilities
+
+### 4. Console statement in production code
+**Category**: Code Quality
+**Effort**: LOW
+
+**Action**: Remove console statement or replace with proper logging framework
+
+### 5. Large file (843 lines)
+**Category**: Code Quality
+**Effort**: HIGH
+
+**Action**: Split into multiple smaller, focused modules
+
+---
+
+## Priority 2: Medium Issues (Fix Next Quarter 📆)
+
+**Timeline**: Within 3 months
+**Impact**: Code maintainability, developer productivity
+
+**Total Issues**: 25
+
+**Grouped by Type**:
+- Typescript Strict Mode: 8 issues
+- Modern Javascript: 5 issues
+- Code Smell: 7 issues
+- Function Length: 5 issues
+
+---
+
+## Priority 3: Low Issues (Backlog 📋)
+
+**Timeline**: When time permits
+**Impact**: Minor improvements, stylistic issues
+
+**Total Issues**: 12
+
+*Address during dedicated tech debt sprints or slow periods*
+
+---
+
+## Suggested Timeline
+
+- **2024-10-22**: All P0 issues resolved
+- **2024-11-04**: P1 issues addressed (end of sprint)
+- **2025-01-20**: P2 issues resolved (end of quarter)
+
+## Effort Summary
+
+**Total Estimated Effort**: 32.5 person-days
+- Critical/High: 18.5 days
+- Medium: 10.0 days
+- Low: 4.0 days
+
+## Team Assignment Suggestions
+
+- **Security Team**: All P0 security issues, P1 vulnerabilities
+- **QA/Testing**: Test coverage improvements, test quality issues
+- **Infrastructure**: CI/CD improvements, build performance
+- **Development Team**: Code quality refactoring, complexity reduction
+
+---
+
+*Remediation plan generated by Codebase Auditor Skill*
+
+*Priority scoring based on: Impact × 10 + Frequency × 5 - Effort × 2*

skills/codebase-auditor/examples/sample_report.md

@@ -0,0 +1,117 @@
+# Codebase Audit Report
+
+**Generated**: 2024-10-21 14:30:00
+**Codebase**: `/Users/connor/projects/example-app`
+**Tech Stack**: javascript, typescript, react, node
+**Total Files**: 342
+**Lines of Code**: 15,420
+
+---
+
+## Executive Summary
+
+### Overall Health Score: **72/100**
+
+#### Category Scores
+
+- **Quality**: 68/100 ⚠️
+- **Testing**: 65/100 ⚠️
+- **Security**: 85/100 ✅
+- **Technical Debt**: 70/100 ⚠️
+
+#### Issue Summary
+
+- **Critical Issues**: 2
+- **High Issues**: 8
+- **Total Issues**: 47
+
+---
+
+## Detailed Findings
+
+### 🚨 CRITICAL (2 issues)
+
+#### Potential API key found in code
+
+**Category**: Security
+**Subcategory**: secrets
+**Location**: `src/utils/api.ts:12`
+
+Found potential secret on line 12
+
+```typescript
+const API_KEY = "sk_live_1234567890abcdef1234567890abcdef";
+```
+
+**Impact**: Exposed secrets can lead to unauthorized access and data breaches
+
+**Remediation**: Remove secret from code and use environment variables or secret management tools
+
+**Effort**: LOW
+
+---
+
+#### Use of eval() is dangerous
+
+**Category**: Security
+**Subcategory**: code_security
+**Location**: `src/legacy/parser.js:45`
+
+Found on line 45
+
+```javascript
+const result = eval(userInput);
+```
+
+**Impact**: eval() can execute arbitrary code and is a security risk
+
+**Remediation**: Refactor to avoid eval(), use safer alternatives like Function constructor with specific scope
+
+**Effort**: MEDIUM
+
+---
+
+### ⚠️ HIGH (8 issues)
+
+#### High cyclomatic complexity (28)
+
+**Category**: Code Quality
+**Subcategory**: complexity
+**Location**: `src/services/checkout.ts:156`
+
+Function has complexity of 28
+
+**Impact**: High complexity makes code difficult to understand, test, and maintain
+
+**Remediation**: Refactor into smaller functions, extract complex conditions
+
+**Effort**: HIGH
+
+---
+
+#### Line coverage below target (65.3%)
+
+**Category**: Testing
+**Subcategory**: test_coverage
+**Location**: `coverage/coverage-summary.json`
+
+Current coverage is 65.3%, target is 80%
+
+**Impact**: Low coverage means untested code paths and higher bug risk
+
+**Remediation**: Add tests to increase coverage by 14.7%
+
+**Effort**: HIGH
+
+---
+
+## Recommendations
+
+1. **Immediate Action Required**: Address all 2 critical security and quality issues before deploying to production.
+2. **Sprint Focus**: Prioritize fixing the 8 high-severity issues in the next sprint. These significantly impact code quality and maintainability.
+3. **Testing Improvements**: Increase test coverage to meet the 80% minimum threshold. Focus on critical paths first (authentication, payment, data processing).
+4. **Security Review**: Conduct a thorough security review and penetration testing given the security issues found.
+
+---
+
+*Report generated by Codebase Auditor Skill (2024-25 Standards)*