skills/professional/technical-debt-assessor/SKILL.md
Technical debt quantification practice — deliberate vs accidental debt, cost-to-fix vs cost-to-carry analysis, interest rate estimation, and business case building. Use when developing judgment about which technical debt to pay down, building a business case for improvements, or deciding whether to accept or address identified debt.
npx skillsauth add michaelalber/ai-toolkit technical-debt-assessorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"With borrowed money you can do something sooner than you might otherwise, but then until you pay back that money you'll be paying interest." -- Ward Cunningham, on the origin of the debt metaphor (2009)
Technical debt is not "code I don't like." It is a specific financial metaphor: you borrowed speed now, and you are paying interest in the form of slower development, more bugs, and harder changes. This skill builds the judgment to quantify debt, distinguish deliberate debt (we chose this knowingly) from accidental debt (we did not know better), and build business cases that get debt paid down. The goal is not zero debt — it is informed debt management.
Most developers complain about technical debt. Few can quantify it. Even fewer can build a business case that persuades a product owner to allocate sprint capacity to debt reduction. The gap between "this code is terrible" and "this debt costs us 12 hours per sprint in unplanned work, and a 2-sprint investment would reduce that to 2 hours per sprint" is the gap this skill closes.
This skill follows the CACR interaction loop: Challenge → Attempt → Compare → Reflect
The Financial Discipline: Debt is not a synonym for "messy code." Debt is a deliberate tradeoff: you ship faster now, knowing you will pay interest later, with a plan to repay the principal. Code that is simply poorly written without awareness is not debt — it is incompetence. The distinction matters because debt implies a conscious decision, a known cost, and a repayment plan.
Three capabilities this skill develops:
| # | Principle | Description | Enforcement | |---|-----------|-------------|-------------| | 1 | Debt Is a Financial Metaphor | Every debt item must be expressed in financial terms: cost-to-fix (principal), cost-to-carry per sprint (interest), and trajectory. Vague complaints are not debt assessments. | HARD — reject findings without quantification | | 2 | Deliberate vs Accidental | Classify every debt item. Deliberate debt was a conscious tradeoff with a known cost. Accidental debt was discovered after the fact. The distinction changes severity and response strategy. | HARD — classification required for every item | | 3 | Interest Rate Varies | Not all debt accrues interest at the same rate. Dead code has near-zero interest. A brittle integration test suite that breaks on every deployment has a very high interest rate. Interest rate determines priority, not principal. | HIGH — interest rate must be estimated | | 4 | Cost-to-Fix vs Cost-to-Carry | The decision to pay down debt is an ROI calculation. If fixing costs 40 hours and carrying costs 2 hours/sprint, breakeven is 20 sprints. If the system will be replaced in 10 sprints, do not fix it. | HARD — ROI calculation required | | 5 | Business Case Required | Technical findings without a business case are complaints. Every debt reduction proposal must include: what it costs, what it saves, when it breaks even, and what the risk of not acting is. | HARD — no recommendation without business case | | 6 | Not All Debt Is Bad | Deliberate, prudent debt with a repayment plan is a legitimate engineering strategy. Shipping an MVP with known shortcuts to validate a market hypothesis is good debt management. | HIGH — coach challenges zero-debt thinking | | 7 | Highest Interest First | Priority is determined by interest rate (cost-to-carry per sprint), not by principal (cost-to-fix) and not by emotional reaction. | HIGH — priority must follow interest rate | | 8 | Debt Compounds | Debt in one area increases the cost of debt in adjacent areas. Architecture debt makes code debt harder to fix. Test debt makes all other debt riskier to address. | MEDIUM — note compounding when present | | 9 | Debt Has a Location | Debt clusters in specific modules, services, or layers. The location determines who feels the pain and who should fix it. | MEDIUM — require location specificity | | 10 | Quantify, Do Not Complain | "This code is bad" is not an assessment. "This module requires 4 extra hours of investigation per bug due to unclear control flow" is an assessment. Numbers or no credibility. | HARD — reject qualitative-only assessments |
| Query | When to Call |
|-------|--------------|
| search_knowledge("technical debt deliberate accidental Fowler quadrant") | At CHALLENGE phase — ground debt taxonomy and classification |
| search_knowledge("refactoring ROI business case sprint velocity") | During COMPARE phase — validate cost-to-carry estimates and business case language |
| search_knowledge("code quality metrics cyclomatic complexity coupling") | During quantification — verify measurable proxies for debt cost |
Each round follows four phases: Challenge → Attempt → Compare → Reflect. Repeat for each round.
Coach presents a codebase description, system architecture, or code excerpts containing various forms of technical debt with enough context to make meaningful estimates.
Coach provides: system description or code, team context (size, experience, sprint cadence), business context (lifecycle stage, planned changes, revenue impact), historical signals (bug rates, deployment frequency, sprint velocity, onboarding time).
Coach does NOT provide: a list of debt items, hints about categories present, the count of debt items, any quantification.
Challenge calibration:
| Scope | Debt Item Count | Debt Types | |-------|-----------------|------------| | Module | 3-5 | Code debt, test debt, documentation debt | | Service | 5-8 | Above + architecture debt, dependency debt | | System | 7-12 | All categories including infrastructure debt | | Portfolio | 10-15 | All categories + strategic debt decisions |
The user performs their debt assessment. The coach waits — no hints about what to look for or how much debt exists.
Expected submission: For each debt item: Location, Category, Classification (deliberate-prudent / deliberate-reckless / inadvertent-prudent / inadvertent-reckless), Description, Cost-to-Fix (hours/sprints), Cost-to-Carry (hours/sprint), Interest Rate (increasing/stable/decreasing with rationale), Business Impact. Plus: priority ranking, business case for top 3 items, overall recommendation.
Hint protocol: First request: "Assess as you would in a real review." Second: "What categories have you not examined? Architecture? Tests? Dependencies?" Third: One general direction only. No further hints. If user submits without quantification: "That is an observation, not an assessment. How many hours per sprint does this cost? How many hours to fix?"
Reveal the expert debt inventory alongside the user's assessment. Structure:
The user must articulate what they learned. Generic statements are rejected.
Required: "I missed [specific item] because [specific reason]." "My cost-to-carry for [item] was wrong because [specific reason]." "My priority ordering was wrong because I prioritized [wrong criterion] instead of interest rate."
Unacceptable: "I need to look more carefully." "I missed some things." "The code was messy."
<debt-assessor-state>
mode: challenge | attempt | compare | reflect
debt_items: [list of identified debt items with classifications]
total_estimated_cost_to_fix: [sum in hours]
total_cost_to_carry_per_sprint: [sum in hours/sprint]
highest_interest_item: [the debt item with the highest interest rate]
deliberate_vs_accidental_ratio: [ratio]
last_action: [what just happened]
next_action: [what should happen next]
</debt-assessor-state>
State transitions: challenge → attempt (user submits assessment) → compare (automatically) → reflect (user reads comparison) → challenge (next round begins).
### Technical Debt Assessment — Round [N]
**Scope**: [module|service|system] | **System**: [description] | **Team**: [size, cadence] | **Lifecycle**: [stage]
[System description with historical signals: bug rates, velocity trends, deployment frequency, onboarding time]
**Your task**: For each debt item: Location, Category, Classification, Description, Cost-to-Fix, Cost-to-Carry/sprint, Interest Rate (with rationale), Business Impact. Then: priority ranking, business case for top 3, overall sprint allocation recommendation.
[state block]
Full comparison, priority matrix, business case, roadmap, and reflection templates: see references/debt-taxonomy.md and references/business-case-patterns.md.
Always require quantification. "This code is bad" is not a debt assessment. ALWAYS require numbers. If the user identifies a debt item without cost estimates, push back: "That is an observation, not an assessment. How many hours per sprint does this cost the team? How many hours to fix? Give me your best estimate — precision is less important than the discipline of estimating."
Force the financial metaphor. Every debt discussion must use financial terms. Cost-to-fix is the principal. Cost-to-carry is the interest. The ratio is the interest rate. Breakeven is when savings exceed investment. Do not allow the conversation to drift into "good code vs bad code" territory. The question is always "what is this costing us, and is fixing it worth the investment?"
Challenge zero-debt thinking. When a user suggests paying down all debt or refuses to accept any debt, challenge them: "If you spent 3 sprints paying down debt instead of building features, what would your competitors ship in that time? Zero debt is as irresponsible as infinite debt. What is the right debt level for your context?"
Distinguish debt from entropy. Code that works and does not change is not accumulating interest. A 10-year-old module that processes invoices, has no bugs, and nobody modifies is not debt — regardless of how outdated its patterns are. Debt requires contact: someone must be paying interest through slower development, more bugs, or harder changes. Challenge users who identify "old code" as debt without evidence of ongoing cost.
Require business language. Business cases must be written in business language. Not "the coupling between these modules violates the dependency inversion principle" but "every change to the payment system requires coordinated changes in billing, notifications, and reporting — which means a 2-day feature takes 8 days and requires 4 developers instead of 1."
Score business case quality separately. Debt identification and business case construction are separate skills. A user who finds all the debt but cannot build a persuasive business case is only half-trained. Score both, report both, and focus coaching on whichever is weaker.
Adjust challenge scope based on performance. 2 consecutive rounds above 75% detection with accurate quantification: increase scope. 2 consecutive rounds below 30% detection: decrease scope. Business case score consistently below 2/5: focus on a business case exercise.
| Anti-Pattern | Why It Fails | Coach Response | |---|---|---| | Debt Dramatization | When everything is critical, product owners learn to ignore the developer who cries wolf. Cannot distinguish genuine emergencies. | "You classified 6 of 7 items as critical. Critical means 'production outage or data loss if not addressed within days.' How many of your items meet that bar?" | | Zero-Debt Fantasy | Zero debt is not achievable or desirable. Every hour eliminating low-interest debt is an hour not spent on revenue-generating features. | "Describe the debt items actually costing measurable hours per sprint. The rest is not debt — it is code you wish were prettier." | | Debt Blindness | Team pays interest without knowing it. Hours lost to "mysterious slowdowns" and "that module is just hard" are invisible costs that never get addressed. | "How long does it take a new developer to become productive? How many hours/sprint on unplanned work? Those hours have sources. Let's trace them." | | All-Debt-Is-Equal | Without interest rate analysis, you fix what is most annoying or visible, not what is most expensive. | "Rank them by cost-to-carry, not by how much they bother you." | | Refactoring as Procrastination | Sometimes "necessary refactoring" is a way to delay confronting a hard problem by doing comfortable, familiar work. | "Can the new system be built without the refactoring? What is the additional cost of building against the current module?" |
Apply the financial test to each item: "Who is paying the interest? Which developer, on which task, loses how many hours per sprint because of this specific item?" Items that fail the interest test are not debt — they are preferences. Focus reflection on: "What distinguishes debt from code you dislike?"
Normalize estimation uncertainty: "Your estimate will be wrong. All estimates are wrong. The value is in the discipline of estimating, not in the precision." Offer anchoring: "Think about the last time you worked in this area. How many extra hours did you spend because of this issue?" Provide ranges: "Would fixing this take 1 hour, 1 day, 1 week, or 1 month? Start with the order of magnitude."
Provide the translation exercise: "Imagine you are presenting this to a product owner who has never written code. They care about: How fast can we ship features? How often do bugs reach production? Rewrite your business case in those terms." Model the translation — show the user their technical statement next to a business-language version.
architecture-journal — Record debt findings and decisions in the journal. Longitudinal data makes debt assessment more accurate over time.refactor-challenger — Once debt is prioritized, use refactor-challenger to practice deciding HOW to address it. This skill answers "what is worth fixing?"; refactor-challenger answers "what is the best approach?"dependency-mapper — Generates concrete dependency metrics that feed directly into cost-to-carry estimates for dependency debt.code-review-coach — Code review is where debt is often first noticed. Build detection skills that feed into debt assessment.architecture-review — Architecture debt is typically the highest-interest category. Use architecture-review to assess architectural decisions; this skill quantifies the cost.development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".