Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentscodebase health check
Automated multi-language code audits for linting, security vulnerabilities, and outdated dependencies.
$5
codebase health check
Example session with this skill installed
Run a health check on this Python project. Check for vulnerabilities and outdated packages, then give me the report.
- Read your context and instructions
- Compiled the codebase health check
- Generated the document
I have completed the health check for the repository. I detected a Python stack using poetry and ran ruff, pip-audit, and poetry show --outdated.
Code Health Report — analytics-api
Generated 2024-05-20 · Scope: full (142 files) · Mode: read-only
Summary
| Area | Status | Critical | High | Medium | Low |
|---|---|---|---|---|---|
| Lint / Quality | 🟡 | 0 | 0 | 4 | 12 |
| Vulnerabilities | 🔴 | 1 | 0 | 0 | 0 |
| Secrets | 🟢 | 0 | 0 | 0 | 0 |
| Outdated deps | 🟡 | 0 | 1 | 2 | 5 |
| Runtime EOL | 🟢 | 0 | 0 | 0 | 0 |
Health score: 62/100 — Critical vulnerability detected in requests library. Fix immediately.
🔥 Fix First
[Critical] CVE-2023-32681 — poetry.lock — Insufficient verify-matching in requests < 2.31.0. Fix: poetry add requests@latest.
2. [High] Outdated Runtime — pyproject.toml — Python 3.8 reaches EOL in 5 months. Plan upgrade to 3.11.
1. Lint & Code Quality
- Tool(s):
ruff· Total: 4 errors, 12 warnings - Top rules:
F401(Unused import),E501(Line too long),B008(Function call in default arg). - Findings:
app/main.py:12(Unused importsys),app/db.py:45(Mutable default argument).
2. Vulnerabilities
Dependency CVEs
| Package | Installed | Fixed in | Severity | ID | Direct/Transitive |
|---|---|---|---|---|---|
| requests | 2.28.1 | 2.31.0 | Critical | GHSA-8mcg-m862-5r52 | Direct |
Code Patterns
| Severity | Confidence | Category | Location | Evidence | Fix |
|---|---|---|---|---|---|
| Medium | Likely | SQLi | app/api.py:22 | execute("SELECT... " + id) | Use params |
3. Versions & Upgrades
| Package | Current | Latest | Type | Risk |
|---|---|---|---|---|
| pydantic | 1.10.7 | 2.7.1 | Major | High (Breaking changes) |
| fastapi | 0.95.0 | 0.111.0 | Minor | Low |
Upgrade Plan
poetry add requests@latest(Security fix)poetry update fastapi uvicorn(Minor updates)poetry add pydantic@latest(Requires manual migration to V2)
Next steps
- Run
poetry add requests@latestto patch the critical vulnerability. - Review the
app/api.pyfile to implement parameterized SQL queries. - Schedule a sprint to migrate Pydantic from V1 to V2.
codebase-health-check.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Stop shipping code with hidden vulnerabilities or outdated dependencies. This skill performs an automated, language-agnostic audit of your entire repository to identify technical debt, security risks, and maintenance gaps. It eliminates the need for manual tool configuration by detecting your stack and running the appropriate native analysis commands.
What it does
- Stack detection identifies languages, package managers, and runtime versions across your directory.
- Multi-layer auditing scans for lint errors, known CVEs, hardcoded secrets, and risky code patterns like SQL injection.
- Dependency analysis flags outdated packages and end-of-life runtimes with prioritized upgrade paths.
- Prioritized reporting generates a structured Markdown report with a weighted health score and actionable fix commands.
- Safe automation applies non-breaking lint fixes and security patches only when explicitly requested.
How it works
- Discovery scans for manifest files like
package.json,requirements.txt, orgo.modto map the ecosystem. - Analysis executes preferred native tools such as
eslint,ruff,cargo audit, ornpm auditbased on availability. - Synthesis aggregates results into a single report, masking secrets and prioritizing critical vulnerabilities.
- Fixing (Optional) creates a new git branch to apply safe auto-fixes and security patches if instructed.
Frameworks & tools
Supports JavaScript/TypeScript, Python, Go, Rust, Java/Kotlin, C#, PHP, Ruby, Dart/Flutter, Swift, C/C++, Docker, and Terraform. Works with native package managers and security scanners like osv-scanner, gitleaks, and semgrep.
Why this beats prompting it yourself
Generic prompts often miss environment-specific lockfiles or fail to use the project's own linter configurations. This skill follows a rigorous multi-step protocol that prefers actual tool output over AI hallucinations, ensuring CVE IDs and version numbers are accurate.
Use cases
- Run a pre-release audit to ensure no secrets or critical CVEs are being shipped to production.
- Generate a technical debt report for a legacy repository you just inherited.
- Automate the identification of end-of-life runtimes and major version lags across microservices.
- Perform a quick security triage on a Pull Request before merging.
Known limitations
Does not run full SAST/DAST or penetration tests. Relies on locally installed tools or basic pattern matching if tools are missing. Large repos (>5k files) are sampled for performance.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
1 install
Downloaded by developers to date
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 4 days ago
- Passed all security checks, Safe to install