Debt ops review
Skill bcanfield/agentic-tech-debt/copilot/skills/debt-ops-review
Audit the tech-debt registry, rank survivors by churn × Fowler quadrant, surface a top-N list, then walk paydown on user follow-up. Use when the user asks to review debt, see what to pay down, work through entries, or check the debt registry. Stale entries drop with "drop A,B,C".From its SKILL.md
npx -y skills add bcanfield/agentic-tech-debt --skill debt-ops-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
3 things to look at
- skips confirmationTells the agent to proceed without asking first, 1 time: "Don't ask the user to confirm before running review.py.".
- 8 stars8 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
- runs commandsInstructs the agent to run 2 commands, including `python3 scripts/review.py` and 1 more.
SKILL.md
3.8 KB, 906 tokens by cl100k_base, as published. Nobody here has run it
debt-ops-review — audit + (on follow-up) walk paydown
Two modes. First turn: print the audit and stop. On a user follow-up ("fix the top one," "walk these," "do A," "pay some down"), apply the rubric below.
First turn: print the audit
Run the bundled review.py (it lives in this skill's scripts/ directory —
reference it with the relative path; your agent resolves it against the skill root):
python3 scripts/review.py
Optional: --top N to surface more than the default 3 candidates.
Re-emit the helper's stdout verbatim in a fenced code block. Some agents collapse long shell outputs — if you don't print it yourself, the user might not see it. Copy exactly: no preamble, no summary, no "want me to fix the top one?" The fenced block preserves column alignment.
Then stop. The user picks the next move.
Paydown mode (only on user follow-up)
Work through requested entries one at a time. Confirm before each fix. Never auto-batch. Never auto-commit.
For each entry, read the registry file, the hotspot, and adjacent tests. Apply this rubric:
- Already fixed? If the marker/symptom the entry describes no longer appears in the hotspot file, say so and add the entry's letter to the drop list. Don't re-fix.
- Cold area? Churn=0 since
created:and age >90d → propose deferring. ~20% of files generate ~80% of debt-related rework; don't pay down vanity refactors. - Prudent-deliberate with payoff_trigger not met? Honor the trigger. Skip with a one-line "trigger not met: <quote>."
- Fix candidate? Propose the smallest change that resolves the entry. Improvement, not perfection — don't refactor surrounding code.
When you fix
- Read the repo first. Check the test framework, adjacent tests, the project's quality commands. Adapt to what exists; don't impose a new style.
- TDD where tests exist. Write a failing test that pins the deferral, then make it pass. Don't weaken or delete existing tests to make a fix pass.
- No tests in this area? Surface that and ask: write one, or fix without?
- Explain why this resolves the entry. Cite the entry's
payoff_triggeror body — don't commit code you can't explain. - Risky fix? Auth, payments, migrations, public APIs, or
ai_authored: true→ run a fresh-context review of the diff before suggesting commit. Fresh-context review catches what the writer's motivated reasoning misses. - Don't commit. Show the diff. The user runs the gates, drops the entry, and commits.
Pacing
Aim for 3–10 entries per session — continuous paydown outperforms stop-the-world batches. If the user says "do them all," push back once: unsupervised AI cleanup measurably increases duplicate blocks and short-term churn. If they insist, still one-at-a-time with diffs surfaced.
Speak plainly
The frontmatter uses a research taxonomy (quadrant, category) for ranking and
grounding — it is not user-facing vocabulary. When you talk about an entry, describe
it in plain words; never say "prudent-inadvertent", "reckless-deliberate",
"code_rot", etc. to the user. Use the entry's body and a plain phrase (e.g. "a
planned tradeoff", "a shortcut you knew about", "came up later") instead. The
review.py output is already translated — match its tone.
Don't
- Don't ask the user to confirm before running
review.py. - Don't paraphrase the helper's stdout. Copy it verbatim into the fenced code block.
- Don't enter paydown mode on the first turn. Stop after the report. Wait for the user's intent.
- Don't auto-commit. Ever.
What ships with it: 1 file
11.6 KB alongside SKILL.md, 1 of them executable
scripts/
- review.pyruns11.6 KB
Gives 0 of the 12 instructions most review quality skills give in 906 tokens
Counted across 1,273 of the 2,403 authors here whose files we hold, read 2026-09-06
- Ask one question at a timein 63 of 1273, across 62 files
- Provide a recommended answer for each questionin 47 of 1273, across 45 files
- Rank findings by severityin 44 of 1273
- Use parameterized queries for database accessin 38 of 1273, across 20 files
- Validate all user input with schemasin 33 of 1273, across 15 files
- Store secrets in environment variablesin 32 of 1273, across 14 files
- Explore the codebase to answer questionsin 31 of 1273, across 29 files
- Store tokens in httpOnly cookiesin 30 of 1273, across 12 files
- Implement rate limiting on API endpointsin 30 of 1273, across 12 files
- Sanitize user-provided HTMLin 29 of 1273, across 11 files
- Return generic error messages to usersin 28 of 1273, across 10 files
- Cite file and line for every findingin 28 of 1273, across 25 files
Said here and by no other author read
- Run the review script on the first turn
- Re-emit script output verbatim in a fenced block
- Stop after printing the audit report
- Read registry file and adjacent tests for each entry
- Propose the smallest change to resolve the entry
- Write a failing test before fixing
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.