plugins/start/skills/analyze/SKILL.md
Deep-dive codebase analysis that explains how things actually work — business rules, architecture patterns, auth flows, data models, integrations, and performance hotspots. Use whenever the user asks "how does X work", "map the Y flow", "what are the business rules for Z", "trace the auth path", "explore the codebase for patterns", "find all [domain concept]", or needs mechanism-level understanding before making a change. Produces What/How/Why findings with file:line evidence, cross-cutting connections, and clean-solution recommendations first.
npx skillsauth add rsmdt/the-startup analyzeInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Act as an analysis orchestrator that discovers, deeply understands, and documents business rules, technical patterns, and system interfaces through iterative investigation. Go past identification — explain how things actually work, why they were built that way, and what a clean solution looks like.
Analysis Target: $ARGUMENTS
Discovery {
category: Business | Technical | Security | Performance | Integration | Data
finding: string
mechanism: string // HOW it works — trace the actual logic, data flow, or control flow
rationale: string // WHY it works this way — design intent, constraints, trade-offs
evidence: string // file:line references (multiple)
implications: string // what this means for the codebase
documentation: string // suggested doc content
location: string // docs/domain/ | docs/patterns/ | docs/interfaces/ | docs/research/
}
State {
target = $ARGUMENTS
perspectives = [] // determined in step 1
mode: Standard | Agent Team
discoveries: Discovery[]
}
Always:
reference/perspectives.md — each perspective maps to a recommended specialist, with Explore as the default for pure discovery). Don't spawn a generic subagent when a dedicated specialist fits better.docs/domain/, docs/patterns/, docs/interfaces/, and docs/research/ is pre-authorized. When the user selects "persist findings", write directly; confirm only the content being persisted, not the directory.Never:
Read reference/perspectives.md for perspective definitions and the focus-area mapping. Resolve $ARGUMENTS to a perspective set:
match (target) { maps to a focus area => select matching perspectives unclear or multi-area => AskUserQuestion to confirm scope before spawning agents }
AskUserQuestion: Standard (default) — parallel fire-and-forget subagents. Fastest for single-cycle analysis. Agent Team — persistent analyst teammates that can coordinate across cycles. Use for broad scope, multi-domain, complex codebase, or when cross-domain synthesis matters.
For each selected perspective, spawn the recommended agent (see reference/perspectives.md) with its depth brief drawn from the perspective's depth expectations. Pass the target and the specific questions each perspective owns.
Standard mode: spawn all perspective agents in parallel in a single response. Agent Team mode: create the team once, assign one analyst per perspective, dispatch.
Process findings in three layers:
Layer 1 — Mechanism check. For each finding, confirm the agent answered HOW. If a finding is surface-level (e.g., "uses caching" with no cache layer, TTL, or invalidation strategy explained), either request a deeper pass from the same agent or investigate the specific gap directly.
Layer 2 — Cross-cutting connections. Map how findings relate: cause-effect chains, shared dependencies, compounding risks (e.g., "unvalidated webhooks × event-before-persist = forged events with no DB record to reconcile against"). These emergent observations are often more valuable than any single finding.
Layer 3 — Solution framing. For every finding that surfaces a problem or opportunity:
Then deduplicate by evidence, group by theme, and build the cycle summary.
Follow reference/output-format.md for the summary structure (Mechanism Findings → Cross-Cutting Observations → Recommendations → Open Questions).
Lead every recommendation with the clean approach and its implications. Only discuss alternatives if the user, after seeing the clean option, explicitly asks.
AskUserQuestion: Continue to next area | Go deeper on [specific finding] | Persist findings to docs/ | Complete analysis
Write approved findings to the perspective's doc location (see reference/perspectives.md — docs/domain/, docs/patterns/, docs/interfaces/, or docs/research/). Writing under docs/ is pre-authorized; confirm the content of each file with the user, not the target directory.
development
Vulnerability review, threat modeling, OWASP patterns, and secure coding assessment. Use when reviewing code security, designing secure systems, performing threat analysis, or validating security implementations.
research
Measurement approaches, profiling patterns, bottleneck identification, and optimization guidance. Use when diagnosing performance issues, establishing baselines, identifying bottlenecks, or planning for scale. Always measure before optimizing.
development
Unified code review skill for correctness, design, readability, security, performance, testability, accessibility, and error-handling conventions. Use when reviewing changes, enforcing quality standards, or identifying technical debt.
development
Unified platform operations guidance for CI/CD pipeline design, deployment strategies, observability, SLI/SLOs, and incident-ready rollouts. Use when building release workflows, production monitoring, or reliability controls.