alirezarezvani/cto-review
c-level-advisor/c-level-agents/skills/cto-review/SKILL.md
/cs:cto-review <plan> — Architecture and scaling interrogation. Tech debt, scaling cliffs, team scaling, build-vs-buy. Use when committing to an architecture, planning for 10x load, or weighing a rebuild against a vendor.
$ install --global
skillsauthnpx skillsauth add alirezarezvani/claude-skills cto-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 13, 2026, 4:11 AM47.7s1 file scanned
SKILL.md
- name:
- cto-review
- description:
- /cs:cto-review <plan> — Architecture and scaling interrogation. Tech debt, scaling cliffs, team scaling, build-vs-buy. Use when committing to an architecture, planning for 10x load, or weighing a rebuild against a vendor.
/cs:cto-review — CTO Forcing Questions
Command: /cs:cto-review <plan>
Pressure-tests architecture and engineering scaling decisions. Six questions to surface the next scaling cliff before you hit it.
When to Run
- Before approving a major architecture change
- Before doubling the engineering team
- Before a build-vs-buy decision > $100K/year
- When a system is showing reliability stress (SLOs missed)
- Before committing to a new platform / language / DB
The Six CTO Questions
1. Scaling Cliff
Where does the current architecture break, in terms of users / requests / data volume?
- Be specific. "It breaks at 10× current load because the primary DB writes saturate."
- If you don't know, run a load test before deciding.
2. Tech Debt Inventory
What's the top tech debt item, what's it costing per week, and when does it become blocking?
python ../../../skills/cto-advisor/scripts/tech_debt_analyzer.py
3. Team Scaling
For each open req, what's the ramp time and contribution model?
python ../../../skills/cto-advisor/scripts/team_scaling_calculator.py
4. Build vs Buy
Why are we building this instead of buying it — and what's the 3-year TCO of each?
- If "we want control" or "it's not that hard" — push back.
- If the answer is "this is our core moat," build.
5. SLO / Reliability
What are the SLOs for this system and what's the current error budget burn?
- Without an SLO, you can't reason about reliability tradeoffs.
- See
engineering/slo-architectfor SLO design.
6. Security & Compliance Surface
What does this expose, and has cs-ciso-advisor signed off?
- Architecture decisions are compliance decisions.
- Loop in cs-ciso-advisor before commit.
Workflow
- Run the tech debt analyzer + team scaling calculator
- Define the scaling-cliff hypothesis explicitly
- Cross-check with cs-ciso-advisor for security implications
- Apply the verdict
Output Format
# CTO Review: <plan>
**Date:** YYYY-MM-DD
## Scaling Cliff
- Current capacity: <metric>
- Break point: <metric>
- Headroom: X months at current growth
## Tech Debt
- Top item: <description>
- Cost per week: $X or N eng-hours
- Blocking date estimate: <date>
## Team
- Open reqs: N
- Median ramp: X months
- Contribution model: <pairing / squad / area>
## Build vs Buy
- 3-year build TCO: $X
- 3-year buy TCO: $X
- Strategic fit: <core / context>
- Decision: BUILD | BUY
## Reliability
- SLO defined: yes / no
- Error budget burn: X% (target < Y%)
## Security
- cs-ciso sign-off: ✅ / ❌
## Verdict
🟢 SHIP | 🟡 SHARPEN | 🔴 BLOCK
## Next Steps
[3 concrete actions]
Routing
/cs:ciso-review— mandatory if data surface changes/cs:cfo-review— for build-vs-buy > $100K/cs:execute— quarterly plan/cs:boardroom— for architecture pivots
Related
- Agent:
cs-cto-advisor - Skill:
cto-advisor - SLO:
../../../../engineering/slo-architect/
Version: 1.0.0
Related Skills
alirezarezvani/weekly-review
development
VerifiedTrustedCommunity
Use when someone wants to run a weekly review, close open loops, audit stalled projects and commitments, get their system back to trusted, restart a lapsed review habit, or says "/cs:weekly-review". Walks David Allen's three-phase loop — GET CLEAR, GET CURRENT, GET CREATIVE — with deterministic scripts that inventory open loops, gate the checklist with named gaps, and score commitment health 0-100.
22,702SKILL.mdUpdated Jul 18, 2026
alirezarezvani/meetings
development
VerifiedTrustedCommunity
Use when someone wants to decide whether a meeting is worth calling, price a meeting in dollars, build a timeboxed agenda with desired outcomes, or turn messy meeting notes into owned action items — or says "should this be a meeting", "/cs:meeting-prep", or "/cs:meeting-actions". Runs a cost gate (ASYNC / NOT-READY / MEET), builds a decision-first agenda, and extracts an owner + due-date checklist that flags every orphan.
22,702SKILL.mdUpdated Jul 18, 2026
alirezarezvani/fable-goal
development
VerifiedTrustedCommunity
Convert a rambling description of a desired outcome into one polished, autonomous /goal prompt ready to paste into a fresh session. Use when the user says "/fable-goal", "turn this into a goal prompt", "write me a fable prompt", "write the prompt that builds X", or rambles about something they want made and asks for the prompt that makes it happen. The output is a single copy-paste prompt, never the build itself. Do NOT use when the user wants the thing built right now in this session — only when they want the PROMPT that will make it happen in a fresh session.
22,702SKILL.mdUpdated Jul 18, 2026
alirezarezvani/deep-work
development
VerifiedTrustedCommunity
Use when someone wants to plan a deep work day, time-block their calendar or task list, budget or cut shallow work, protect focus hours, track deep-work sessions and streaks, run an end-of-day shutdown ritual, or says "/deep-work" or "/time-block". Classifies tasks deep vs shallow, builds an energy-first time-blocked schedule that refuses deep demand past the 4-hour ceiling, batches shallow work into at most two windows, and logs focus sessions against a weekly target.
22,702SKILL.mdUpdated Jul 18, 2026