Skip to content
Back to skills

Sdd Plan Audit

ASecurity

SDD audit when an architectural-analysis report must become workstreams with TechSpec and tasks; does not audit or implement.

  • 3 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 19, 2026
ai-agentsgorefactoring

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned September 25, 2026

npx -y skills add dougcunha/TokenHound --skill sdd-plan-audit --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Sdd Plan Audit?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Sdd Plan Audit
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/dougcunha-sdd-plan-audit/badge)](https://www.skillsdirectory.com/skills/dougcunha-sdd-plan-audit)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: sdd-plan-audit
description: SDD audit when an architectural-analysis report must become workstreams with TechSpec and tasks; does not audit or implement.
argument-hint: --report .audits/architectural-analysis-[timestamp].md [--update]
disable-model-invocation: true
---

# Plan SDD audit

An `architectural-analysis` report becomes **workstreams**: each workstream is an SDD feature in `tasks/prd-[slug]/`, executable by `sdd-orchestrate-tasks`. Contracts and tasks follow the owning skills, which this session runs itself; this skill slices, sequences, and maintains the **destination map**, which links each finding to the workstream and task that resolves it. Subagents are read-only explorers. The report is immutable and no code is changed.

1. **Fix the report.** Resolve `.audits/architectural-analysis-[timestamp].md` by argument; without one, use the most recent by timestamp and report the choice. An argument that does not resolve while other reports exist: list them and request a choice. With no report at all, stop without writing anything and tell the user to run `architectural-analysis`, which only they invoke. Read the resolved report once. Look for the map `.audits/architectural-analysis-[timestamp].destinations.md`: if it exists, reuse IDs, workstreams, and states, and change it only with `--update`. When the map lists workstreams, check their folders for an `active` `context-snapshot.md` and, if one exists, load it through the Load branch of `.agents/skills/sdd-snapshot/SKILL.md` and resume from its next step.
   Locate `sdd-plan-refactoring`, `sdd-create-prd`, `sdd-create-techspec`, and `sdd-plan-tasks` in `.agents/skills/`. A missing skill blocks only the route that depends on it.
   **Output:** exact report, previous map and snapshot reconciled, and each route's skills located; or a stop with no files written and the missing report reported.
2. **Inventory findings.** Walk the five dimensions — dead code, duplication, anti-patterns, type safety, smells — by content, not by headings: real reports rename sections, write findings in prose, and record corrected false positives. Every table row, duplication group, or described hotspot gets `AA-NN` in order of appearance, with dimension, `file:line`, severity or confidence, and recommendation. An aggregate count beyond the listed items becomes a single finding for the rule, with the count as baseline; without named files, it enters a workstream only at the user's request and is otherwise deferred. Summary, statistics, impact, "None found", and corrected false positives are context and get no ID.
   Check each finding against the smallest excerpt of current code — the report ages. With many findings, split the check by dimension or directory across parallel read-only explorers that return the proposed class and cited evidence; this session assigns the final class. Classify: **actionable** (confirmed), **resolved** (no longer exists), **discarded** (contrary evidence cited), or **pending** (depends on a decision or environment). For `Possibly dead`, LOW confidence, and use through reflection, dependency injection, XAML bindings, or configuration, first run the verification the report names; only what it does not decide stays pending.
   **Output:** every finding has an ID, class, and current evidence.
3. **Slice workstreams.** Group actionable findings by cause, with one reviewable outcome per workstream: confirmed dead code; one duplication or contract group; one god object or layer boundary; defects with a concrete failure path (async misuse, synchronous I/O on the UI thread, captive dependency, swallowed exception); nullability posture per project; local smells per target file. Merge findings the same extraction resolves — `Prioritized Actions` and `Risk Areas` point to that coupling. Order removal before consolidation and consolidation before decomposition; a target file shared between workstreams becomes an explicit dependency. Name them `[NN]-arch-[YYYYMMDD]-[workstream]` with the report date, numbered after the highest folder under `tasks/`.
   Decide each workstream's route — this is where it is decided whether a TechSpec is needed:

   | Workstream | Route |
   | --- | --- |
   | Preserves observable behavior: removal, consolidation, decomposition, coupling, layers, types, smells | `sdd-plan-refactoring` writes `prd.md` and `techspec.md` |
   | Fixes a defect and changes observable behavior: a failure becomes logged or propagated, synchronous blocking becomes async | `sdd-create-prd`, then `sdd-create-techspec` |
   | `tasks/prd-[slug]/` already has a PRD and TechSpec valid for the scope | Reused: no new contract |

   When writing the map, read [assets/destinations.template.md](assets/destinations.template.md) in full; workstreams enter as `proposed`.
   **Output:** every actionable finding belongs to exactly one workstream; each workstream has a route and dependencies without cycles; map written.
4. **Approve the slicing.** Present each workstream with slug, `AA-NN`, route, dependencies, and risk, and list resolved, discarded, and pending findings separately. Ask which workstreams to plan — through the available question tool (`AskUserQuestion`) when the options fit, in text when they do not — and accept regrouping. A workstream not chosen becomes `deferred` in the map with its findings.
   **Output:** each workstream `approved` or `deferred` by the user's answer, recorded in the map; `tasks/` untouched until then.
5. **Generate contracts.** For each approved, non-reused workstream, in dependency order, follow the route's skill by exact path in this session with slug, the workstream's findings (ID, `file:line`, current evidence, recommendation), and sibling workstreams as boundaries. Keep `AA-NN` as the obligation ID in the PRD scope and in the TechSpec's `DEC-NN` and `QA-NN` that eliminate it: that is how tasks inherit traceability. On the refactoring route, the finding's counts are the quality profile baseline and the target is to eliminate them. Read-only explorers may trace several workstreams in parallel; this session writes one workstream's contracts at a time.
   After each workstream except the last, run the session pause from `session-continuity.md` with stage `planning` and the next workstream as next step; a written snapshot goes to that workstream's folder and the previous one is marked `superseded`.
   Present the written contracts at a single HIL — preserved behaviors, decisions, and pending items for all workstreams — before decomposing; correct whatever is refused through the owning skill.
   **Output:** each approved workstream has accepted `prd.md` and `techspec.md`, or a block with a concrete cause that affects only it.
6. **Plan tasks.** For each workstream with accepted contracts, follow `.agents/skills/sdd-plan-tasks/SKILL.md` for `--prd [slug]` in this session. Rules, templates, validation profile, and coverage gate are its own, applied without local adaptation. Run the session pause between workstreams as in step 5.
   **Output:** each workstream has `tasks.md` and `task_*.md` with the coverage gate filled in, or a block returned by the skill.
7. **Close the map.** Record on each `AA-NN` the workstream and tasks that cover it, read from the traceability matrix in `tasks.md`, or its final destination. Check that every actionable finding of a planned workstream appears in at least one task and that the map's links resolve. Present workstreams, execution order, risks, and pending items; implementation authorization stays with the user. Point the snapshot's next step at `sdd-orchestrate-tasks` for the first workstream, or mark it `closed`.
   **Output:** no finding without a destination in the map; execution indicated as `sdd-orchestrate-tasks --prd [slug]` in map order.

New report on code with a previous map: reconcile findings by file and rule, preserve workstreams in progress, and number new workstreams after the highest existing one. A workstream whose source changes during planning invalidates only its own derivatives.

Files in this skill

  • SKILL.md6.9 KB
  • agents/openai.yaml43 B
  • assets/destinations.template.md1.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.