srstomp/feature-audit
plugins/pokayokay/skills/feature-audit/SKILL.md
Use when verifying feature completeness against PRD requirements, identifying gaps between backend implementation and user-facing accessibility, generating remediation tasks, or auditing across frameworks (Next.js, React Router, TanStack, React Native, Expo).
$ install --global
skillsauthnpx skillsauth add srstomp/pokayokay feature-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 27, 2026, 7:04 AM21.5s7 files scanned
SKILL.md
- name:
- feature-audit
- agents:
- [yokay-auditor]
- description:
- Use when verifying feature completeness against PRD requirements, identifying gaps between backend implementation and user-facing accessibility, generating remediation tasks, or auditing across frameworks (Next.js, React Router, TanStack, React Native, Expo).
Feature Audit
Ensures features are not just implemented but actually user-accessible. Bridges the gap between "code complete" and "user can use it."
When NOT to Use
- Analyzing agent/session patterns — Use
session-reviewfor retrospectives on how work went - Security review — Use
security-auditfor vulnerability scanning; this skill checks feature completeness, not security - Creating the plan — Use
planningto break down PRDs into tasks; this skill audits after implementation
Completeness Levels
| Level | Name | Meaning | |-------|------|---------| | 0 | Not Started | No implementation evidence | | 1 | Backend Only | Service/API exists, no frontend | | 2 | Frontend Exists | UI components exist, not accessible | | 3 | Routable | Has route/screen, not in navigation | | 4 | Accessible | In navigation, users can reach it | | 5 | Complete | Accessible + documented + tested |
Quick Start Checklist
- Discover project framework and structure
- Load PRD context from
.claude/features.jsonandtasks.db - For each feature: check backend, frontend, route, navigation
- Assign completeness level (0-5)
- Generate report and remediation tasks
Key Principles
- Always verify in codebase — don't trust task status alone
- Check full accessibility chain: backend → frontend → route → navigation → docs
- Generate specific remediation tasks (not generic "add frontend")
- Priority follows feature priority (P0 gap = P0 remediation)
References
| Reference | Description | |-----------|-------------| | framework-patterns.md | Scanning patterns for each framework | | completeness-criteria.md | Detailed level definitions and checklists | | gap-analysis.md | Analysis methodology | | remediation-templates.md | Task templates for common gaps | | scanning-process.md | Backend, frontend, API, navigation scans | | anti-patterns.md | Audit and remediation anti-patterns |
Related Skills
srstomp/worktrees
development
VerifiedTrustedCommunity
Git worktree management for isolated task development
6SKILL.mdUpdated Apr 27, 2026
srstomp/work-session
development
VerifiedTrustedCommunity
Use when starting AI development sessions, resuming interrupted work, managing multi-session projects, or orchestrating work with human checkpoint control (supervised, semi-auto, auto, or unattended modes).
6SKILL.mdUpdated Apr 27, 2026
srstomp/verification-before-completion
testing
VerifiedTrustedCommunity
Use before claiming work is done, fixed, passing, ready to commit, ready to PR, or ready to mark complete. Requires fresh verification evidence and explicit command output before success claims.
6SKILL.mdUpdated Apr 27, 2026
srstomp/testing-strategy
development
VerifiedTrustedCommunity
Use when designing test architecture, building API test suites, validating API contracts, setting up component or E2E testing, managing test data, debugging flaky tests, reviewing coverage strategy, or organizing test files. Covers test pyramid, mocking (MSW), frontend (React Testing Library, Playwright), and CI integration.
6SKILL.mdUpdated Apr 27, 2026