npx skills add https://github.com/0xdarkmatter/claude-mods --skill techdebt使用并行子代理进行自动化技术债务检测。设计用于在会话结束时运行,以便在上下文尚新时发现问题。
# 会话结束 - 扫描自上次提交以来的变更(默认)
/techdebt
# 深度扫描 - 分析整个代码库
/techdebt --deep
# 特定类别
/techdebt --duplicates # 仅重复代码
/techdebt --security # 仅安全问题
/techdebt --complexity # 仅复杂度热点
/techdebt --deadcode # 仅死代码
# 自动修复模式(交互式)
/techdebt --fix
始终使用并行子代理以实现快速分析:
Main Agent (orchestrator)
│
├─> Subagent 1: Duplication Scanner
├─> Subagent 2: Security Scanner
├─> Subagent 3: Complexity Scanner
└─> Subagent 4: Dead Code Scanner
↓ All run in parallel (2-15s depending on scope)
Main Agent: Consolidate findings → Rank by severity → Generate report
优势:
默认(无标志):
git diff --name-only HEADAutomated technical debt detection using parallel subagents. Designed to run at session end to catch issues while context is fresh.
# Session end - scan changes since last commit (default)
/techdebt
# Deep scan - analyze entire codebase
/techdebt --deep
# Specific categories
/techdebt --duplicates # Only duplication
/techdebt --security # Only security issues
/techdebt --complexity # Only complexity hotspots
/techdebt --deadcode # Only dead code
# Auto-fix mode (interactive)
/techdebt --fix
Always uses parallel subagents for fast analysis:
Main Agent (orchestrator)
│
├─> Subagent 1: Duplication Scanner
├─> Subagent 2: Security Scanner
├─> Subagent 3: Complexity Scanner
└─> Subagent 4: Dead Code Scanner
↓ All run in parallel (2-15s depending on scope)
Main Agent: Consolidate findings → Rank by severity → Generate report
Benefits:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
深度扫描(--deep 标志):
特定类别(例如 --duplicates):
同时启动 4 个子代理(如果指定了类别,则启动子集):
子代理 1:重复代码扫描器
ast-grep、结构搜索、令牌分析子代理 2:安全扫描器
子代理 3:复杂度扫描器
子代理 4:死代码扫描器
子代理指令模板:
Scan {scope} for {category} issues.
Scope: {file_list or "entire codebase"}
Language: {detected from file extensions}
Focus: {category-specific patterns}
Output format:
- File path + line number
- Issue description
- Severity (P0-P3)
- Suggested fix (if available)
Use appropriate tools:
- Duplication: ast-grep for structural similarity
- Security: pattern matching + known vulnerability patterns
- Complexity: cyclomatic complexity calculation
- Dead Code: static analysis for unused symbols
主代理收集所有子代理的结果并:
创建可操作的报告:
# Tech Debt Report
**Scope:** {X files changed | Entire codebase}
**Scan Time:** {duration}
**Debt Score:** {0-100, lower is better}
## Summary
| Category | Findings | P0 | P1 | P2 | P3 |
|----------|----------|----|----|----|----|
| Duplication | X | - | X | X | - |
| Security | X | X | - | - | - |
| Complexity | X | - | X | X | - |
| Dead Code | X | - | - | X | X |
## Critical Issues (P0)
### {file_path}:{line}
**Category:** {Security}
**Issue:** Hardcoded API key detected
**Impact:** Credential exposure risk
**Fix:** Move to environment variable
## High Priority (P1)
### {file_path}:{line}
**Category:** {Duplication}
**Issue:** 45-line block duplicated across 3 files
**Impact:** Maintenance burden, inconsistency risk
**Fix:** Extract to shared utility function
[... continue for all findings ...]
## Recommendations
1. Address all P0 issues before merge
2. Consider refactoring high-complexity functions
3. Remove dead code to reduce maintenance burden
## Auto-Fix Available
Run `/techdebt --fix` to interactively apply safe automated fixes.
如果提供了 --fix 标志:
识别安全修复:
交互式提示:
Fix: Remove unused import 'requests' from utils.py:5
[Y]es / [N]o / [A]ll / [Q]uit
应用更改:
安全规则:
AST 相似性检测:
ast-grep 进行结构模式匹配基于令牌的分析:
阈值:
模式检测:
| 模式 | 严重性 | 示例 |
|---|---|---|
| 硬编码密钥 | P0 | API_KEY = "sk-..." |
| SQL 注入风险 | P0 | f"SELECT * FROM users WHERE id={user_id}" |
| 不安全的加密 | P0 | hashlib.md5(), random.random() for tokens |
| 路径遍历 | P0 | open(user_input) 无验证 |
| XSS 漏洞 | P0 | HTML 中未转义的用户输入 |
| Eval/exec 使用 | P1 | eval(user_input) |
| 弱密码 | P2 | 硬编码的默认密码 |
语言特定检查:
pickle 使用、yaml.load() 未使用 SafeLoadereval()、innerHTML 包含用户数据指标:
| 指标 | P1 阈值 | P2 阈值 |
|---|---|---|
| 圈复杂度 | >15 | >10 |
| 函数长度 | >100 行 | >50 行 |
| 嵌套深度 | >5 层 | >4 层 |
| 参数数量 | >7 | >5 |
重构建议:
检测方法:
安全移除标准:
第 1 层(完全支持):
ast-grep、radon、pylintast-grep、eslint、jscpdgocyclo、golangci-lintclippy、cargo-audit第 2 层(基本支持):
语言检测:
添加到您的工作流:
## Session Wrap-Up Checklist
- [ ] Run `/techdebt` to scan changes
- [ ] Address any P0 issues found
- [ ] Create tasks for P1/P2 items
- [ ] Commit clean code
创建 .claude/hooks/pre-commit.sh:
#!/bin/bash
# Auto-run tech debt scan before commits
echo "🔍 Scanning for tech debt..."
claude skill techdebt --quiet
if [ $? -eq 1 ]; then
echo "❌ P0 issues detected. Fix before committing."
exit 1
fi
echo "✅ No critical issues found"
在拉取请求上运行深度扫描:
# .github/workflows/techdebt.yml
name: Tech Debt Check
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run tech debt scan
run: claude skill techdebt --deep --ci
随时间跟踪债务:
# 初始基线
/techdebt --deep --save-baseline
# 与基线比较
/techdebt --compare-baseline
# 输出:"Debt increased by 15% since baseline"
基线存储在 .claude/techdebt-baseline.json:
{
"timestamp": "2026-02-03T10:00:00Z",
"commit": "a28f0fb",
"score": 42,
"findings": {
"duplication": 8,
"security": 0,
"complexity": 12,
"deadcode": 5
}
}
在 .claude/techdebt-rules.json 中添加项目特定模式:
{
"security": [
{
"pattern": "TODO.*security",
"severity": "P0",
"message": "Security TODO must be resolved"
}
],
"complexity": {
"cyclomatic_threshold": 12,
"function_length_threshold": 80
}
}
/techdebt --format=json # JSON 输出用于工具集成
/techdebt --format=markdown # Markdown 报告(默认)
/techdebt --format=sarif # SARIF 用于 IDE 集成
问题:扫描超时
--deep,或增加超时时间问题:误报过多
.claude/techdebt-rules.json 中调整阈值--ignore-patterns 标志排除测试文件问题:缺少依赖项(ast-grep 等)
npm install -g @ast-grep/cli 安装工具,或跳过该类别另请参阅:
每周安装数
8
仓库
GitHub 星标数
8
首次出现
Feb 5, 2026
安全审计
安装于
opencode8
gemini-cli8
replit7
claude-code7
codex7
github-copilot6
Default (no flags):
git diff --name-only HEADDeep scan (--deep flag):
Specific category (e.g.,--duplicates):
Launch 4 subagents simultaneously (or subset if category specified):
Subagent 1: Duplication Scanner
ast-grep, structural search, token analysisSubagent 2: Security Scanner
Subagent 3: Complexity Scanner
Subagent 4: Dead Code Scanner
Subagent instructions template:
Scan {scope} for {category} issues.
Scope: {file_list or "entire codebase"}
Language: {detected from file extensions}
Focus: {category-specific patterns}
Output format:
- File path + line number
- Issue description
- Severity (P0-P3)
- Suggested fix (if available)
Use appropriate tools:
- Duplication: ast-grep for structural similarity
- Security: pattern matching + known vulnerability patterns
- Complexity: cyclomatic complexity calculation
- Dead Code: static analysis for unused symbols
Main agent collects results from all subagents and:
Create actionable report with:
# Tech Debt Report
**Scope:** {X files changed | Entire codebase}
**Scan Time:** {duration}
**Debt Score:** {0-100, lower is better}
## Summary
| Category | Findings | P0 | P1 | P2 | P3 |
|----------|----------|----|----|----|----|
| Duplication | X | - | X | X | - |
| Security | X | X | - | - | - |
| Complexity | X | - | X | X | - |
| Dead Code | X | - | - | X | X |
## Critical Issues (P0)
### {file_path}:{line}
**Category:** {Security}
**Issue:** Hardcoded API key detected
**Impact:** Credential exposure risk
**Fix:** Move to environment variable
## High Priority (P1)
### {file_path}:{line}
**Category:** {Duplication}
**Issue:** 45-line block duplicated across 3 files
**Impact:** Maintenance burden, inconsistency risk
**Fix:** Extract to shared utility function
[... continue for all findings ...]
## Recommendations
1. Address all P0 issues before merge
2. Consider refactoring high-complexity functions
3. Remove dead code to reduce maintenance burden
## Auto-Fix Available
Run `/techdebt --fix` to interactively apply safe automated fixes.
If --fix flag provided:
Identify safe fixes:
Interactive prompts:
Fix: Remove unused import 'requests' from utils.py:5
[Y]es / [N]o / [A]ll / [Q]uit
Apply changes:
Safety rules:
AST Similarity Detection:
ast-grep for structural pattern matchingToken-based Analysis:
Thresholds:
Pattern Detection:
| Pattern | Severity | Example |
|---|---|---|
| Hardcoded secrets | P0 | API_KEY = "sk-..." |
| SQL injection risk | P0 | f"SELECT * FROM users WHERE id={user_id}" |
| Insecure crypto | P0 | hashlib.md5(), random.random() for tokens |
| Path traversal | P0 | open(user_input) without validation |
| XSS vulnerability | P0 | Unescaped user input in HTML |
| Eval/exec usage | P1 | eval(user_input) |
| Weak passwords | P2 | Hardcoded default passwords |
Language-specific checks:
pickle usage, yaml.load() without SafeLoadereval(), innerHTML with user dataMetrics:
| Metric | P1 Threshold | P2 Threshold |
|---|---|---|
| Cyclomatic Complexity | >15 | >10 |
| Function Length | >100 lines | >50 lines |
| Nested Depth | >5 levels | >4 levels |
| Number of Parameters | >7 | >5 |
Refactoring suggestions:
Detection methods:
Safe removal criteria:
Tier 1 (Full support):
ast-grep, radon, pylintast-grep, eslint, jscpdgocyclo, golangci-lintclippy, cargo-auditTier 2 (Basic support):
Language detection:
Add to your workflow:
## Session Wrap-Up Checklist
- [ ] Run `/techdebt` to scan changes
- [ ] Address any P0 issues found
- [ ] Create tasks for P1/P2 items
- [ ] Commit clean code
Create .claude/hooks/pre-commit.sh:
#!/bin/bash
# Auto-run tech debt scan before commits
echo "🔍 Scanning for tech debt..."
claude skill techdebt --quiet
if [ $? -eq 1 ]; then
echo "❌ P0 issues detected. Fix before committing."
exit 1
fi
echo "✅ No critical issues found"
Run deep scan on pull requests:
# .github/workflows/techdebt.yml
name: Tech Debt Check
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Run tech debt scan
run: claude skill techdebt --deep --ci
Track debt over time:
# Initial baseline
/techdebt --deep --save-baseline
# Compare against baseline
/techdebt --compare-baseline
# Output: "Debt increased by 15% since baseline"
Baseline stored in .claude/techdebt-baseline.json:
{
"timestamp": "2026-02-03T10:00:00Z",
"commit": "a28f0fb",
"score": 42,
"findings": {
"duplication": 8,
"security": 0,
"complexity": 12,
"deadcode": 5
}
}
Add project-specific patterns in .claude/techdebt-rules.json:
{
"security": [
{
"pattern": "TODO.*security",
"severity": "P0",
"message": "Security TODO must be resolved"
}
],
"complexity": {
"cyclomatic_threshold": 12,
"function_length_threshold": 80
}
}
/techdebt --format=json # JSON output for tooling
/techdebt --format=markdown # Markdown report (default)
/techdebt --format=sarif # SARIF for IDE integration
Issue: Scan times out
--deep only on smaller modules, or increase timeoutIssue: Too many false positives
.claude/techdebt-rules.json--ignore-patterns flag to exclude test filesIssue: Missing dependencies (ast-grep, etc.)
npm install -g @ast-grep/cli or skip categorySee also:
Weekly Installs
8
Repository
GitHub Stars
8
First Seen
Feb 5, 2026
Security Audits
Installed on
opencode8
gemini-cli8
replit7
claude-code7
codex7
github-copilot6
AI新闻播客制作技能:实时新闻转对话式播客脚本与音频生成
1,200 周安装