Zorille

zorille

Four Claude Code skills for finding what's wrong in a codebase you don't know and doing something useful about it: bugs, fix plans, dependency hygiene, and upstream-contribution forensics.

Four skills, one repo

• /codebase-audit finds problems. Cold-start audit of any codebase: bugs, security issues, architectural problems, tech debt, test gaps. Writes a structured report and a baseline.json for regression tracking. Read-only by default; opt in to mechanical fixes with --quick-fix.
• /plan-fixes turns problems into fix plans. Reads the baseline /codebase-audit writes — or any SARIF 2.1.0 source (CodeQL, ESLint, Semgrep, Sonar, GitHub Code Scanning). Groups findings into PR-sized plans with depth-aware investigation: callers, tests, and adjacent context.
• /deps handles dependency hygiene. Audit, update, and CVE remediation across Go, Python, Swift, Dart/Flutter, C#/.NET, and Node.js. Risk-tiered updates (critical → security → patch → minor) with test verification; never auto-bumps majors without approval. Standalone — doesn't require the audit/plan-fixes flow, but complements /codebase-audit's quick CVE scan with deeper investigation and remediation.
• /issue-forensics applies investigative rigor to a non-trivial finding before you file an upstream issue or PR. Four-question entry gate routes routine fixes to a quick-report template; substantive findings get a five-pillar playbook: SHA-pinned permalinks, structural twins, history with stated-intent-vs-side-effect discipline, disproof of current design, exhaustive caller trace. Produces a structured draft modelled on a gold-standard exemplar. Companion to give-back for anti-squatting hold-and-release timing.

The slash commands are `/codebase-audit`, `/plan-fixes`, `/deps`, and `/issue-forensics` regardless of where you cloned the repo. (For the story behind the repo name, see the bottom of this file.)

What this solves

You inherited a codebase you don't know. You n