
Project Audit
- 55 installs
- 1 repo stars
- Updated July 19, 2026
- fearovex/claude-config
Run a capped, script-driven discovery pass over a repo to map CLAUDE.md, skills layout, ai-context docs, and global versus local agent config before fixing setup drift.
About
project-audit is an agent skill from the fearovex claude-config ecosystem that helps solo builders see whether their AI coding setup matches how they actually work. Instead of ad-hoc grepping, Phase A runs a single discovery script that records whether root or `.claude/CLAUDE.md` exists, which skills directory layout is in use, and which `ai-context` markdown artifacts are present—with optional line counts for oversized files. The design constraint matters: at most three Bash invocations per full audit, so the skill stays safe for agents with shell access. Use when onboarding to a unfamiliar repo, after copying a global config template, or when agents behave inconsistently because stack or conventions docs are missing. Outcomes feed later audit phases (not fully shown in the snippet) so you can align install/sync scripts with local skills. It does not replace security review or test suites; it maps the skeleton your agent relies on so you can iterate on documentation and skill paths deliberately.
- Phase A discovery is one consolidated shell call—audit run budget of maximum 3 total Bash calls
- Detects global-config layouts via `install.sh`/`sync.sh` or `skills/_shared` versus `.claude/skills`
- Emits structured facts: CLAUDE.md presence, ai-context files (stack, architecture, conventions, known-issues, changelog-
- Consumed by `SKILL.md` as reference for automated project structure audits
Project Audit by the numbers
- 55 all-time installs (skills.sh)
- Ranked #1,591 of 3,282 Productivity & Planning skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Jul 24, 2026 (Skillselion catalog sync)
npx skills add https://github.com/fearovex/claude-config --skill project-auditAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 55 |
|---|---|
| repo stars | ★ 1 |
| Security audit | 3 / 3 scanners passed |
| Last updated | July 19, 2026 |
| Repository | fearovex/claude-config ↗ |
What it does
Run a capped, script-driven discovery pass over a repo to map CLAUDE.md, skills layout, ai-context docs, and global versus local agent config before fixing setup drift.
Files
project-audit
Triggers: /project-audit, audit project, review claude config, sdd diagnostic, project health check
---
<!-- Structural floor ~440 lines. Add new content to sibling files, not here. -->
Read-only diagnostic of Claude/SDD config. Flow: /project-audit → audit-report.md → /project-fix → /project-audit (verify). The report IS the spec /project-fix implements. Kernel: discovery → evaluation → report (stable; rules evolve). Save report at [project_root]/.claude/audit-report.md.
Sibling reference files — REPORT_TEMPLATE.md (output format), SCORING.md (100-point distribution + interpretation), PHASE_A_SCRIPT.md (discovery script + schema).
Dimension classes
| Class | Dimensions | Score impact |
|---|---|---|
| Scored | D1, D2, D3, D4, D6, D7, D8 | 100-pt score |
| Informational | D9, D10, D11, D12, D13, D14 | None |
D5 was removed. Informational dimensions never affect score unless stated.
Compatibility policy — global-config exemptions
IS_GLOBAL_CONFIG=1 → the methodology repo is not a consumer of its own deployment. Skip table:
| Dim. | Check | Skip when global-config |
|---|---|---|
| D1 | Stack / package.json | Skip |
| D1 | ## Architecture section | Skip (in README) |
| D1 | Skills registry | Skip ALWAYS (Principle 2 — harness auto-discovers) |
| D1 | ai-context/ path refs | Skip |
| D2 | Memory (ai-context/) | Skip dim; N/A in score |
| D4a | Registry vs disk | Skip |
Rationale: ai-context/ is deployed BY this repo INTO consumer projects via /project-setup — auditing the methodology repo for it is a category error. Scoring: D2 → N/A; denominator becomes 75. Final = round(actual/75*100).
---
Process
Read real files. Never assume. Run dimensions systematically.
Phase A — Discovery
Run PHASE_A_SCRIPT.md once; capture key=value outputs; run the post-script "Legacy commands/ detection". Max 3 Bash calls total per audit run.
Phase B — Per-dimension evaluation
Apply each dimension. Findings carry severity (CRITICAL/HIGH/MEDIUM/LOW/INFO) and optional FIX_MANIFEST entries.
Dimension 1 — CLAUDE.md
Project type detection: IS_GLOBAL_CONFIG=1 → global-config. Accept root CLAUDE.md as equivalent to .claude/CLAUDE.md. Note Project Type in report.
| Check | Severity |
|---|---|
Exists .claude/CLAUDE.md (or root for global-config) | CRITICAL |
| Not empty (>50 lines) | CRITICAL |
Has Stack section (## Tech Stack or ## Stack) | CRITICAL |
| Stack has ≥ 3 technologies with explicit versions | CRITICAL |
Stack matches package.json / pyproject.toml | HIGH |
Has ## Architecture section | HIGH |
| Has Skills registry | HIGH |
| Has Unbreakable Rules section | MEDIUM |
| Has Plan Mode section | LOW |
Mentions SDD (/sdd-*) | HIGH |
References to ai-context/ paths are correct | MEDIUM |
Stack severity is CRITICAL per ADR-004 (every tech-reference skill routes on it). Exemptions under IS_GLOBAL_CONFIG=1: see "Compatibility policy".
Stack comparison: extract top 5–10 deps from package.json/equivalent, compare with CLAUDE.md. Report discrepancies as declared X.Y, actual A.B.
Template path verification: locate ## Documentation Conventions section, extract paths matching docs/templates/*.md, verify each exists. Each missing → MEDIUM + required_actions.medium type: create_file. Skip entirely if no such pattern found.
---
Dimension 2 — Memory (ai-context/)
Skip entirely when IS_GLOBAL_CONFIG=1 — emit INFO "D2 skipped — global-config repos do not use ai-context/". D2 → N/A (25 pts excluded from denominator). See Compatibility policy.
For standard projects:
| File | Min lines | Note |
|---|---|---|
ai-context/stack.md | > 30 | |
ai-context/architecture.md | > 40 | |
ai-context/conventions.md | > 30 | |
ai-context/known-issues.md | > 10 | may be brief for new projects |
ai-context/changelog-ai.md | > 5 | at least one entry |
Location may be ai-context/ or docs/ai-context/. Check both.
Content checks (per existing file):
stack.md: top-5 dependency versions matchpackage.json.architecture.md: directories named exist on disk.conventions.md: documented conventions appear in 2–3 sample real files.known-issues.md: real content vs.[To confirm]/[Empty]stubs.changelog-ai.md: at least one## YYYY-MM-DDentry.
Placeholder phrase detection — scan content for (case-insensitive in brackets, case-sensitive for plain TODO): [To be filled], [empty], [TBD], [placeholder], [To confirm], [Empty], plain uppercase TODO. Each match → HIGH "[filename] appears to contain unfilled placeholder content". Treat the file as functionally empty even if line count passes. Add to required_actions.high with type: update_file.
stack.md version count — count lines matching x.y, x.y.z, or vX. < 3 → MEDIUM "stack.md lists fewer than 3 technologies with concrete versions — minimum is 3". Skip when stack.md absent or already placeholder.
User documentation freshness (for ai-context/scenarios.md and ai-context/quick-reference.md):
- Absent → LOW
"[filename] missing — create via /project-onboard or manually". - Present → search first 10 lines for
^> Last verified: (\d{4}-\d{2}-\d{2})$.
Missing/malformed → LOW. > 90 days old → LOW with age. All findings LOW, no D2 score deduction.
---
Dimension 3 — SDD Orchestrator
3a. Global SDD skills — 8 phase skills must exist in ~/.claude/skills/: sdd-explore, sdd-propose, sdd-spec, sdd-design, sdd-tasks, sdd-apply, sdd-verify, sdd-archive. Any missing → CRITICAL.
3b. Engram availability — call mem_context. Reachable → INFO log. Unreachable → HIGH "Engram not reachable — SDD artifacts will not persist".
3c. CLAUDE.md mentions SDD — contains any /sdd-* → HIGH if absent; section explaining SDD flow → LOW if absent.
3d. Orphaned changes — mem_search(query: "sdd/", project: "{project}"), filter for state artifacts with last_updated > 14 days ago and no archive-report. List them.
3e. Hook script existence — for each settings file present (settings.json, .claude/settings.json, settings.local.json), locate hooks key and extract script paths. Each missing on disk → HIGH + required_actions.high type: create_file. Skip when no hooks key.
3f. Active changes conflict detection: 1. Search engram for active changes (no archive-report). Retrieve each design.md. 2. Locate ## File Change Matrix table. Extract File column. Normalize: lowercase + strip leading ./. 3. Skip if fewer than 2 active changes have a design.md. 4. Intersect path sets. Each overlap → MEDIUM "Concurrent file modification conflict: [path] is targeted by both [change-A] and [change-B]". Add to violations[], rule: "D3-active-changes-conflict".
Normalization only handles lowercase + leading ./. Other format inconsistencies are not caught.
---
Dimension 4 — Skills quality
4a. Registry vs disk (bidirectional): each skill in CLAUDE.md exists on disk; each skill on disk appears in CLAUDE.md. Report mismatches both ways.
Skip 4a when IS_GLOBAL_CONFIG=1 (no manual registry exists; Principle 2). Emit INFO "D4a skipped — harness auto-discovery, not a manual registry". 4b and 4c still apply.
4b. Minimum content — for each skill file:
- < 30 lines → probable stub.
- Format-aware structural check (see
docs/format-types.md):
1. Parse YAML frontmatter, extract format:. Absent → treat as procedural. 2. Unknown value → INFO, treat as procedural.
| Resolved format | Required sections | Finding if absent (MEDIUM) |
|---|---|---|
procedural | ## Process | "procedural skill [name] missing ## Process section" |
reference | At least one of ## Patterns/## Critical Patterns AND one of ## Examples/## Code Examples | "reference skill [name] missing (## Patterns or ## Critical Patterns) or (## Examples or ## Code Examples)" |
anti-pattern | ## Anti-patterns OR ## Critical Patterns | "anti-pattern skill [name] missing ## Anti-patterns or ## Critical Patterns section" |
Missing **Triggers** or ## Rules → MEDIUM for all formats. Missing ## Process is NOT a finding for reference/anti-pattern.
Each finding → required_actions.medium, type: skill_quality_action, action_type: add_missing_section, target: [skill path], missing_sections: ["[heading]"].
4c. Relevant tech skills coverage (scored 0–10 pts):
Stack → skill mapping: React 18+ → react-19, Next.js 14+ → nextjs-15, TypeScript → typescript, Zustand → zustand-5, Tailwind → tailwind-4, Zod → zod-4, Playwright → playwright, Prisma → prisma, React Native / Expo → react-native, Go → go-testing.
Coverage rule (tech-skill locality policy): a skill counts as "covered" if it exists EITHER in the project's local .claude/skills/<name>/ OR in the global ~/.claude/skills/<name>/. Tech skills are expected to live locally; only meta/orchestrator skills are expected globally. Penalizing a project for not having zod-4 globally when it has it locally is a category error.
| Coverage of applicable skills | Points |
|---|---|
| 100% covered OR no applicable | 10 |
| ≥ 75% | 8 |
| 50–74% | 5 |
| 25–49% | 2 |
| < 25% | 0 |
"Applicable" = project uses the tech AND a matching skill exists locally or globally. D4 max: 20 pts (4a+4b = 10; 4c = 10).
---
Dimension 6 — Cross-reference integrity
Everything referenced in the Claude configuration must exist on disk.
| Source | Target |
|---|---|
## Documentation in CLAUDE.md | .claude/docs/ |
| Templates section in CLAUDE.md | .claude/templates/ |
| Paths inside skills | /lib/, /domain/, pages/api/, etc. |
ai-context/architecture.md dirs | Project filesystem |
| Skills referenced in commands | The skill file |
Each broken reference: source file, approximate line, missing path.
---
Dimension 7 — Architecture compliance
Input: analysis-report.md at project root (produced by /project-analyze).
| Condition | Score | Severity | Message |
|---|---|---|---|
analysis-report.md absent | 0/5 | CRITICAL | "Run /project-analyze first, then re-run /project-audit" |
Present + architecture.md absent | 2/5 | HIGH | "No architecture baseline to compare against" |
Drift = none | 5/5 | OK | |
Drift = minor | 3/5 | MEDIUM | List drift entries |
Drift = significant | 0/5 | HIGH | List drift entries |
Staleness penalty (when ANALYSIS_REPORT_EXISTS=1):
| Age | Deduction |
|---|---|
| ≤ 30 days | none |
| 31–60 days | −1 pt (floor: 0) |
| > 60 days | −2 pts (floor: 0) |
Emit "analysis-report.md is [N] days old — staleness penalty applied". Stacks with drift; combined floor 0.
When drift is minor/significant, read ## Architecture Drift from the report and list entries.
D7 violations go in violations[] only — NOT required_actions. /project-fix does not auto-fix architecture drift.
---
Dimension 8 — Testing & verification
8a. Test runner configured or detectable → HIGH if missing. Documented testing strategy in ai-context/ → MEDIUM if missing.
8b. For each archive-report in engram, verify a verify-report exists and references tool execution results. Missing → HIGH.
8c. For each active change with tasks, verify the task plan includes verification criteria. For each with design, verify the design defines test approach.
---
Dimension 9 — Project skills quality (informational)
Skip when $LOCAL_SKILLS_DIR does not exist — emit "No [value] directory found — Dimension 9 skipped". No deduction.
Global-config circular detection: when auditing the global-config repo, every subdir under skills/ has a matching counterpart in ~/.claude/skills/ (same files via install.sh). Disposition keep for all — expected.
D9-2 Duplicate — for each subdir under $LOCAL_SKILLS_DIR: ~/.claude/skills/<name>/ exists → disposition move-to-global (if differs) or delete (if identical). Global catalog unreadable → INFO, disposition keep.
D9-3 Structural completeness — apply D4b format-aware check. Missing required section OR missing SKILL.md → disposition update, action add_missing_section.
D9-4 Language compliance — D4e heuristic on body text outside fenced code. Non-English prose → disposition update, action flag_language_violation, severity INFO (no deduction).
D9-5 Stack relevance — technology references in trigger line and title. If absent from both ai-context/stack.md AND package.json/pyproject.toml → disposition update, action flag_irrelevant, severity INFO. No stack source → emit "Stack relevance check skipped — no stack source found".
---
Dimension 10 — Feature docs coverage (informational)
Skip when no features detected.
Config-driven — if project config.yaml has feature_docs: key, read convention (skill|markdown|mixed), paths, and feature_detection.
Heuristic fallback — sources, in order: 1. Non-SDD skills in $LOCAL_SKILLS_DIR (names not starting with sdd-, project-, memory-, skill-). 2. *.md files in docs/features/ or docs/modules/. 3. Subdirs of src/features/, src/modules/, app/ with a README.md.
Exclude always: shared, utils, common, lib, types, hooks, components. Empty after exclusions → emit "No feature directories detected — Dimension 10 skipped".
Per-feature checks:
- D10-a Coverage: PASS if doc exists per convention; FAIL otherwise.
- D10-b Structure: SKILL.md → PASS if frontmatter +
**Triggers**+
## Process + ## Rules. Other .md → PASS if H1 + ≥1 H2.
- D10-c Freshness: extract paths
/src/[^\s]+,/lib/[^\s]+,
/app/[^\s]+. Each missing → flag stale.
- D10-d Registry alignment: SKILL.md in
.claude/skills/not in CLAUDE.md
registry → INFO (not a warning).
D10 findings MUST NOT appear in required_actions or skill_quality_actions.
---
Dimension 11 — Internal coherence (informational)
Read/Glob/Grep only — no Bash. Skip when neither $LOCAL_SKILLS_DIR nor root CLAUDE.md exists.
D11-a Count consistency — extract claims via CLAIM_PATTERN = /(\d+)\s+(Dimensions?|Steps?|Rules?|Phases?|Checks?|Sub-checks?)/i from headings and blockquote lines. Count matching body sections. Mismatch → INFO. Do NOT match inside code blocks.
D11-b Numbering continuity — patterns: /^#{2,3}\s+.*Step\s+(\d+)/im, Dimension\s+(\d+), Phase\s+(\d+), /^#{2,4}\s+.*D(\d+)/m. Sort numbers, detect gaps and duplicates. ≥ 2 members required. Severity INFO.
D11-c Frontmatter-body alignment — if description has a numeric claim, verify via D11-a logic. Mismatch → INFO.
All D11 findings → violations[], severity info, rule names D11-count-consistency, D11-numbering-continuity, D11-frontmatter-body. Never in required_actions.
---
Dimension 12 — ADR coverage (informational)
Activation: CLAUDE.md contains string docs/adr/. If absent → emit INFO, skip.
D12-1: ADR_README_EXISTS=0 → HIGH "CLAUDE.md references docs/adr/ but docs/adr/README.md is missing" + required_actions.high type: create_file.
D12-2: Glob docs/adr/NNN-*.md. No matches → INFO "docs/adr/ contains no ADR files yet". Each ADR: search ## Status heading or frontmatter status: field. Neither → MEDIUM "ADR file [filename] is missing a valid status field" + required_actions.medium type: update_file. Valid: accepted, deprecated, superseded; custom allowed, do not validate value.
---
Dimension 13 — Spec coverage (informational)
Activation: Engram reachable AND mem_search(query: "sdd/") returns spec artifacts.
D13-1: For each spec.md, extract path-like references (contain /, no spaces, not in URLs or fenced code). Check existence at [project_root]/[path]. Missing → INFO "Spec artifact references a path that no longer exists: [path]". Add to violations[], rule: "D13-stale-path-reference", severity: "info", file: "engram spec artifact". INFO findings NOT in required_actions.
---
Dimension 14 — Budget compliance (informational)
Runs on every audit.
1. Read CLAUDE.md at project root; count characters. 2. Global-config (install.sh + sync.sh exist) → 20,000 char budget; otherwise → 5,000. 3. Over budget → INFO "CLAUDE.md is [N] chars ([N-budget] over [budget] budget). Consider extracting content to skills (ADR-041)". 4. Within → INFO "CLAUDE.md budget OK: [N]/[budget] chars".
Findings go in ## Budget Compliance section. No score impact.
---
Report
Save at [project_root]/.claude/audit-report.md using the exact structure in REPORT_TEMPLATE.md. Scoring distribution and interpretation live in SCORING.md.
---
Rules
1. Always read real files. Never assume content. 2. Run in a subagent with read tools. Never in main context. 3. Always save the report at .claude/audit-report.md before presenting. 4. The FIX_MANIFEST is valid YAML. Verify the block parses. 5. Never modify anything. 100% read-only. 6. If a file cannot be read, report ❌ with the exact error. Do not assume absence. 7. When finished: "Report saved in .claude/audit-report.md. To implement: /project-fix". 8. All shell discovery in Phase A. Max 3 Bash calls per run. No per-dimension ls/grep/wc -l/find. 9. Compatibility behavior is explicit, not implicit in a dimension.
project-audit — Phase A Discovery Script
Reference file consumed by SKILL.md. Phase A is the single consolidatedshell call that gathers all structural facts from the project. Maximum 3
total Bash calls per audit run; this script counts as 1.
Reference script
#!/usr/bin/env bash
# project-audit discovery — Phase A
# Usage: bash <(echo "$SCRIPT") [project_root]
PROJECT="${1:-.}"
f() { [ -f "$PROJECT/$1" ] && echo 1 || echo 0; }
d() { [ -d "$PROJECT/$1" ] && echo 1 || echo 0; }
lc() { [ -f "$PROJECT/$1" ] && wc -l < "$PROJECT/$1" || echo 0; }
echo "CLAUDE_MD_EXISTS=$(f .claude/CLAUDE.md)"
echo "ROOT_CLAUDE_MD_EXISTS=$(f CLAUDE.md)"
echo "ENGRAM_REACHABLE=<check via mem_context>"
echo "INSTALL_SH_EXISTS=$(f install.sh)"
echo "SYNC_SH_EXISTS=$(f sync.sh)"
# Global-config detection for LOCAL_SKILLS_DIR
if [ "$INSTALL_SH_EXISTS" = "1" ] && [ "$SYNC_SH_EXISTS" = "1" ]; then
LOCAL_SKILLS_DIR="skills"
IS_GLOBAL_CONFIG=1
elif [ -d "$PROJECT/skills/_shared" ]; then
LOCAL_SKILLS_DIR="skills"
IS_GLOBAL_CONFIG=1
else
LOCAL_SKILLS_DIR=".claude/skills"
IS_GLOBAL_CONFIG=0
fi
echo "LOCAL_SKILLS_DIR=$LOCAL_SKILLS_DIR"
echo "IS_GLOBAL_CONFIG=$IS_GLOBAL_CONFIG"
echo "STACK_MD_EXISTS=$(f ai-context/stack.md)"
echo "ARCH_MD_EXISTS=$(f ai-context/architecture.md)"
echo "CONV_MD_EXISTS=$(f ai-context/conventions.md)"
echo "ISSUES_MD_EXISTS=$(f ai-context/known-issues.md)"
echo "CHANGELOG_MD_EXISTS=$(f ai-context/changelog-ai.md)"
echo "CLAUDE_MD_LINES=$(lc CLAUDE.md)"
echo "STACK_MD_LINES=$(lc ai-context/stack.md)"
# Orphaned changes — detected via engram search for stale SDD state artifacts
ORPHANED="<detected via mem_search for sdd/*/state artifacts older than 14 days>"
echo "ORPHANED_CHANGES=${ORPHANED:-NONE}"
# SDD phase skills present
SDD_COUNT=0
for phase in explore propose spec design tasks apply verify archive; do
[ -f "$HOME/.claude/skills/sdd-$phase/SKILL.md" ] && SDD_COUNT=$((SDD_COUNT+1))
done
echo "SDD_SKILLS_PRESENT=$SDD_COUNT"
echo "FEATURE_DOCS_CONFIG_EXISTS=<check config.yaml at project root if it exists>"
echo "ANALYSIS_REPORT_EXISTS=$(f analysis-report.md)"
echo "ANALYSIS_REPORT_DATE=$(head -5 "$PROJECT/analysis-report.md" 2>/dev/null | grep 'Last analyzed:' | awk '{print $3}' || echo '')"
echo "ROOT_SETTINGS_JSON_EXISTS=$(f settings.json)"
echo "DOTCLAUDE_SETTINGS_JSON_EXISTS=$(f .claude/settings.json)"
echo "SETTINGS_LOCAL_JSON_EXISTS=$(f settings.local.json)"
echo "ADR_DIR_EXISTS=$(d docs/adr)"
echo "ADR_README_EXISTS=$(f docs/adr/README.md)"
echo "ENGRAM_HAS_SPECS=<check via mem_search for sdd/*/spec artifacts>"Output key schema
Each key is a key=value line in stdout:
CLAUDE_MD_EXISTS— 1 if.claude/CLAUDE.mdexists, 0 if absentROOT_CLAUDE_MD_EXISTS— 1 if rootCLAUDE.mdexists, 0 if absentENGRAM_REACHABLE— 1 if Engram MCP is reachable, 0 if notINSTALL_SH_EXISTS— 1 ifinstall.shexists at project root, 0 if absentSYNC_SH_EXISTS— 1 ifsync.shexists at project root, 0 if absentLOCAL_SKILLS_DIR— string:"skills"(global-config detected via Condition A or B) or".claude/skills"(standard project)IS_GLOBAL_CONFIG— 1 if the project IS the global-config repo itself (install.sh + sync.sh, ORskills/_shared/present); 0 for any other project. Used by D1, D2, D4a to skip checks that don't apply when auditing the methodology repo itself.STACK_MD_EXISTS— 1 ifai-context/stack.mdexists, 0 if absentARCH_MD_EXISTS— 1 ifai-context/architecture.mdexists, 0 if absentCONV_MD_EXISTS— 1 ifai-context/conventions.mdexists, 0 if absentISSUES_MD_EXISTS— 1 ifai-context/known-issues.mdexists, 0 if absentCHANGELOG_MD_EXISTS— 1 ifai-context/changelog-ai.mdexists, 0 if absentCLAUDE_MD_LINES— integer line count of rootCLAUDE.md(0 if absent)STACK_MD_LINES— integer line count ofai-context/stack.md(0 if absent)ORPHANED_CHANGES— comma-separated names of orphaned change dirs, orNONESDD_SKILLS_PRESENT— integer count of present~/.claude/skills/sdd-*/SKILL.mdfiles (0–8)FEATURE_DOCS_CONFIG_EXISTS— 1 if project config.yaml contains afeature_docs:key, 0 if absentANALYSIS_REPORT_EXISTS— 1 ifanalysis-report.mdexists at project root, 0 if absentANALYSIS_REPORT_DATE— ISO date string from theLast analyzed:field ofanalysis-report.md, or empty string if absentROOT_SETTINGS_JSON_EXISTS— 1 ifsettings.jsonexists at project root, 0 if absentDOTCLAUDE_SETTINGS_JSON_EXISTS— 1 if.claude/settings.jsonexists, 0 if absentSETTINGS_LOCAL_JSON_EXISTS— 1 ifsettings.local.jsonexists at project root, 0 if absentADR_DIR_EXISTS— 1 ifdocs/adr/directory exists, 0 if absentADR_README_EXISTS— 1 ifdocs/adr/README.mdexists, 0 if absentENGRAM_HAS_SPECS— 1 if engram contains spec artifacts for this project, 0 if absent
Legacy commands/ detection (post-script check)
After running Phase A, check whether .claude/commands/ exists in the project root:
if [ -d "$PROJECT/.claude/commands" ]; then
emit LOW finding: "Legacy .claude/commands/ directory detected — migrate to .claude/skills/ following the official Claude Code standard."
fi- Severity: LOW (informational)
- Score penalty: none
- FIX_MANIFEST entry: none (do NOT add a
required_actionsentry for this finding)
Phase A extension — analysis-report.md
After Phase A completes, two variables are available for Dimension 7 in Phase B:
ANALYSIS_REPORT_EXISTS— 1 ifanalysis-report.mdexists at the project root, 0 if absentANALYSIS_REPORT_DATE— ISO date string from theLast analyzed:field, or empty string if absent
Important constraints:
project-auditdoes NOT invokeproject-analyzeautomatically.analysis-report.mdis treated as external input produced by a prior/project-analyzerun.- D7 in Phase B reads
ANALYSIS_REPORT_EXISTSandANALYSIS_REPORT_DATEto compute its score and staleness warning. - These variables are added to the existing Phase A script — no additional Bash call is introduced. Total Bash calls per audit run remain ≤ 3.
project-audit — Report Template
Reference file consumed by SKILL.md. The audit writes its output to.claude/audit-report.md using the exact structure below. Placeholders insquare brackets are filled at generation time.
---
`````markdown
Audit Report — [Project Name]
Generated: [YYYY-MM-DD HH:MM] Score: [XX/100] SDD Ready: [YES|NO|PARTIAL]
---
FIX_MANIFEST
<!-- This block is consumed by /project-fix — DO NOT modify manually -->
score: [XX]
sdd_ready: [true|false|partial]
generated_at: "[timestamp]"
project_root: "[absolute path]"
required_actions:
critical:
- id: "[unique-id]"
type: "[create_file|update_file|create_dir|add_registry_entry|install_skill]"
target: "[path or element]"
reason: "[why it is necessary]"
template: "[template_name if applicable]"
high:
- id: "[unique-id]"
type: "..."
target: "..."
reason: "..."
medium:
- ...
low:
- ...
missing_global_skills:
- "[skill-name]"
orphaned_changes:
- name: "[name]"
last_phase: "[phase]"
days_inactive: [N]
violations:
- file: "[path]"
line: [N]
rule: "[violated rule]"
severity: "[critical|high|medium]"
skill_quality_actions:
- id: "D9-<skill-name>-<action-type>"
skill_name: "<name>"
local_path: ".claude/skills/<name>/SKILL.md"
global_counterpart: "~/.claude/skills/<name>/SKILL.md"
action_type: "delete_duplicate|add_missing_section|flag_irrelevant|flag_language"
disposition: "delete|move-to-global|update|keep"
missing_sections: ["## Rules", "## Process"]
detail: "<human-readable reason>"
severity: "info|warning"---
Executive Summary
[3-5 lines describing the general state of the project from the Claude/SDD perspective]
---
Score: [XX]/100
| Dimension | Points | Max | Status |
|---|---|---|---|
| CLAUDE.md complete and accurate | [X] | 20 | ✅/⚠️/❌ |
| Memory initialized | [X]/N/A | 15 | ✅/⚠️/❌/— |
| Memory with substantial content | [X]/N/A | 10 | ✅/⚠️/❌/— |
| SDD Orchestrator operational | [X] | 20 | ✅/⚠️/❌ |
| Skills registry complete and functional | [X] | 20 | ✅/⚠️/❌ |
| Cross-references valid | [X] | 5 | ✅/⚠️/❌ |
| Architecture compliance | [X] | 5 | ✅/⚠️/❌ |
| Testing & Verification integrity | [X] | 5 | ✅/⚠️/❌ |
| Project Skills Quality | N/A | N/A | ✅/ℹ️/— |
| Feature Docs Coverage | N/A | N/A | ✅/ℹ️/— |
| Internal Coherence | N/A | N/A | ✅/ℹ️/— |
| ADR Coverage | N/A | N/A | ✅/ℹ️/— |
| Spec Coverage | N/A | N/A | ✅/ℹ️/— |
| Budget Compliance | N/A | N/A | ✅/ℹ️/— |
| TOTAL | [X] | 100 or 75 (global-config: D2 excluded) |
SDD Readiness: [FULL / PARTIAL / NOT CONFIGURED]
- FULL: Engram reachable, CLAUDE.md mentions /sdd-*, global skills present
- PARTIAL: Some SDD elements present but incomplete
- NOT CONFIGURED: Engram not reachable and no SDD references in CLAUDE.md
---
Dimension 1 — CLAUDE.md [OK|WARNING|CRITICAL]
| Check | Status | Detail |
|---|---|---|
Exists .claude/CLAUDE.md (or root CLAUDE.md for global-config repos) | ✅/❌ | |
| Has >50 lines | ✅/❌ | [X] lines |
| Stack documented | ✅/⚠️/❌ | |
| Stack vs package.json | ✅/⚠️/❌ | [specific discrepancies] |
| Has Architecture section | ✅/⚠️/❌ | |
| Skills registry present | ✅/⚠️/❌ | |
| Mentions SDD (/sdd-\*) | ✅/⚠️/❌ |
Stack Discrepancies: [List each discrepancy: "Declares React 18, actual ^19.0.0"]
Template path verification:
| Template path | Exists |
|---|---|
| docs/templates/prd-template.md | ✅/❌ |
| docs/templates/adr-template.md | ✅/❌ |
[or: "No docs/templates/*.md paths found in CLAUDE.md — check skipped"]
---
Dimension 2 — Memory [OK|WARNING|CRITICAL]
| File | Exists | Lines | Content | Coherence |
|---|---|---|---|---|
| stack.md | ✅/❌ | [N] | ✅/⚠️/❌ | ✅/⚠️/❌ |
| architecture.md | ✅/❌ | [N] | ✅/⚠️/❌ | ✅/⚠️/❌ |
| conventions.md | ✅/❌ | [N] | ✅/⚠️/❌ | ✅/⚠️/❌ |
| known-issues.md | ✅/❌ | [N] | ✅/⚠️/❌ | ✅/⚠️/❌ |
| changelog-ai.md | ✅/❌ | [N] | ✅/⚠️/❌ | N/A |
Coherence issues detected: [List specific issues with file + what is outdated]
Placeholder phrase detection:
| File | Phrase found | Severity |
|---|---|---|
| stack.md | "[To be filled]" | ⚠️ HIGH |
[or: "No placeholder phrases detected"]
stack.md technology count: [N] version entries detected (minimum: 3) — ✅/⚠️
---
Dimension 3 — SDD Orchestrator [OK|WARNING|CRITICAL]
Global SDD Skills:
| Skill | Exists |
|---|---|
| sdd-explore | ✅/❌ |
| sdd-propose | ✅/❌ |
| sdd-spec | ✅/❌ |
| sdd-design | ✅/❌ |
| sdd-tasks | ✅/❌ |
| sdd-apply | ✅/❌ |
| sdd-verify | ✅/❌ |
| sdd-archive | ✅/❌ |
Engram availability:
| Check | Status |
|---|---|
| Engram MCP reachable | ✅/❌ |
CLAUDE.md mentions SDD: ✅/❌
Orphaned changes: [none | list]
Hook script existence:
| Hook event | Script path | Exists |
|---|---|---|
| [event] | [path] | ✅/❌ |
[or: "No hooks key found in settings files — check skipped"]
Active changes — file conflict detection:
| File | Change A | Change B |
|---|---|---|
| [path] | [change-name] | [change-name] |
[or: "No conflicts detected"] [or: "Fewer than two active changes have design.md — check skipped"]
---
Dimension 4 — Skills [OK|WARNING|CRITICAL]
Skills in registry but not on disk: [list or "none"]
Skills on disk but not in registry: [list or "none"]
Skills with insufficient content (<30 lines): [list or "none"]
Recommended global tech skills not installed: [list with install command: /skill-add name]
---
Dimension 6 — Cross-references [OK|WARNING|CRITICAL]
Broken references:
| Source file | Reference | Problem |
|---|
[list or "none"]
---
Dimension 7 — Architecture Compliance [OK|WARNING|CRITICAL]
Analysis report found: YES/NO Last analyzed: [date or N/A] Report age: [N days | N/A] Architecture drift status: [none|minor|significant|N/A] Staleness penalty: [none | −1 pt (report is [N] days old, > 30 days) | −2 pts (report is [N] days old, > 60 days)]
Drift entries: (when drift is present)
| File/Pattern | Expected | Found |
|---|---|---|
| [entry] | [expected] | [found] |
---
Dimension 8 — Testing & Verification [OK|WARNING|CRITICAL]
Project has test runner: ✅/❌
Archived changes without verify-report: [list or "none"]
Archived changes with empty verify-report.md (without [x]): [list or "none"]
Verify rules are executable: ✅/⚠️/❌
---
Dimension 9 — Project Skills Quality [OK|INFO|SKIPPED]
Local skills directory: [value of $LOCAL_SKILLS_DIR] — [N skills found | not found — skipped]
| Skill | Duplicate of global | Structural complete | Language OK | Stack relevant | Disposition |
|---|---|---|---|---|---|
| [skill-name] | ⚠️ YES / ❌ NO | ✅ / ⚠️ (missing: list) | ✅ / ℹ️ violation | ✅ / ℹ️ flag / ℹ️ UNKNOWN | keep/update/delete/move-to-global |
Skills with missing structural sections: [list or "none"] Language violations (INFO — manual fix required): [list or "none"] Stack relevance issues (INFO): [list or "none"]
_Note: Dimension 9 does not affect the score in this iteration. Findings are informational unless action_type is delete_duplicate._
---
Dimension 10 — Feature Docs Coverage [OK|INFO|SKIPPED]
Detection mode: configured | heuristic | skipped Features detected: [N] ([list of names])
| Feature | Doc found | Structure OK | Fresh | In Registry | Status |
|---|---|---|---|---|---|
| [name] | ✅/❌ | ✅/⚠️/N/A | ✅/⚠️/N/A | ✅/ℹ️/N/A | ✅/⚠️/❌ |
_D10 findings are informational only — they do not affect the score and are not auto-fixed by /project-fix._
---
Dimension 11 — Internal Coherence [OK|INFO|SKIPPED]
Skills scanned: [N] from $LOCAL_SKILLS_DIR
| Skill | Count OK | Numbering OK | Frontmatter OK | Findings |
|---|---|---|---|---|
| [skill-name] | ✅/⚠️ | ✅/⚠️ | ✅/⚠️/N/A | [detail or "clean"] |
Inconsistencies found: [N] across [M] skills (or "None — all skills internally coherent")
_D11 findings are informational only — they do not affect the score and are not auto-fixed by /project-fix._
---
Dimension 12 — ADR Coverage [OK|INFO|SKIPPED]
Condition: CLAUDE.md references docs/adr/ — YES/NO ADR README exists: ✅/❌ ADRs scanned: [N]
| ADR | Status field found | Status value | Finding |
|---|---|---|---|
| [001-example.md] | ✅/❌ | [accepted/deprecated/superseded/—] | clean/Missing ## Status section |
[or: "ADR Coverage check skipped — docs/adr/ not referenced in CLAUDE.md"] [or: "docs/adr/ contains no ADR files yet"]
_D12 findings are informational only — no score impact._
---
Dimension 13 — Spec Coverage [OK|INFO|SKIPPED]
Condition: Engram reachable and spec artifacts found — YES/NO Domains detected: [list of domain names]
| Domain | spec.md found | Stale paths | Status |
|---|---|---|---|
| [name] | ✅/❌ | [N] | ✅/⚠️/❌ |
[or: "Spec Coverage check skipped — no spec artifacts found in engram"]
_D13 findings are informational only — no score impact._
---
Budget Compliance [INFO]
Project type: agent-config (20,000 char global budget) | other project (5,000 char project budget)
CLAUDE.md character count: [N] chars — [OK: N/budget | OVER: N chars over budget]
_Budget Compliance findings are informational only — no score impact. See ADR-041 for budget governance details._
---
Required Actions
Critical (block SDD):
1. [concrete action] → run /project-fix or manually: [instruction]
High (degrade quality):
1. [concrete action]
Medium:
1. [concrete action]
Low (optional improvements):
1. [concrete action]
---
_To implement these corrections: run /project-fix_ _This report was generated by /project-audit — do not modify the FIX_MANIFEST block manually_ `````
project-audit — Scoring Rubric
Reference file consumed by SKILL.md. Defines the 100-point distributionacross scored dimensions, informational-only dimensions, and the score
interpretation table.
Dimension scoring table
| Dimension | Criterion | Max points |
|---|---|---|
| CLAUDE.md | Exists + complete structure + accurate stack + SDD refs | 20 |
| Memory — existence | All 5 files exist | 15 |
| Memory — quality | Substantial content + coherent with code | 10 |
| SDD Orchestrator | Global skills + Engram availability + CLAUDE.md refs | 20 |
| Skills | Registry accuracy + content depth = 10 pts; global tech skills coverage (D4c) = 10 pts | 20 |
| Cross-references | No broken references | 5 |
| Architecture | No critical violations in samples | 5 |
| Testing & Verification | config.yaml has testing block + archived changes have verify-report.md | 5 |
| Project Skills Quality | Informational only — no score deduction in iteration 1. Flags duplicates, structural gaps, language violations, stack relevance issues. | N/A |
| Feature Docs Coverage | Informational only — no score deduction. Detects feature/skill documentation gaps. | N/A |
| Internal Coherence | Informational only — no score deduction. Validates count claims, section numbering, and frontmatter consistency within individual skill files. | N/A |
| ADR Coverage | Informational only — no score deduction. Activated when CLAUDE.md references docs/adr/. Verifies README.md exists and each ADR file has a status field. HIGH/MEDIUM findings are actionable by /project-fix. | N/A |
| Spec Coverage | Informational only — no score deduction. Activated when engram has spec artifacts. Verifies spec path references are valid on disk. MEDIUM findings are actionable by /project-fix. | N/A |
| Budget Compliance | Informational only — no score deduction. Reports CLAUDE.md character count against ADR-041 governance budgets (20k global / 5k project). | N/A |
Global-config exemptions
When Phase A reports IS_GLOBAL_CONFIG=1, two scored dimensions become N/A because they describe consumer-project structure, not methodology-repo structure (see "Compatibility policy" in SKILL.md for the full rationale):
| Dimension | Behavior in global-config mode |
|---|---|
| Memory — existence | N/A — ai-context/ is deployed BY this repo, not present IN it |
| Memory — quality | N/A — same |
Recompute the denominator: max = 100 - 25 = 75. Final score: round((actual / 75) * 100). Report the table with D2 existence: N/A and D2 quality: N/A and a footnote: "D2 excluded — global-config repo (see config-guidelines Principle 1)."
D4a (registry vs disk, sub-criterion of D4) is also skipped under IS_GLOBAL_CONFIG=1, but D4 keeps its 20-point max (4b + 4c cover content depth and global tech skills coverage, both still applicable).
Score interpretation
| Score range | Meaning |
|---|---|
| 90-100 | SDD fully operational, excellent maintenance |
| 75-89 | Ready to use SDD, minor improvements pending |
| 50-74 | SDD partially configured, needs /project-fix |
| < 50 | Requires complete setup |
SDD Readiness flag
Independent from the numeric score. Set as follows:
- FULL — Engram reachable, CLAUDE.md mentions
/sdd-*, all 8 global SDD skills present. - PARTIAL — Some SDD elements present but at least one of the FULL conditions fails.
- NOT CONFIGURED — Engram not reachable AND no SDD references in CLAUDE.md.
Related skills
FAQ
Is Project Audit safe to install?
skills.sh reports 3 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.