<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
    <channel>
        <title>Codebase Auditing on Producthunt daily</title>
        <link>https://producthunt.programnotes.cn/en/tags/codebase-auditing/</link>
        <description>Recent content in Codebase Auditing on Producthunt daily</description>
        <generator>Hugo -- gohugo.io</generator>
        <language>en</language>
        <lastBuildDate>Wed, 11 Nov 2026 23:11:19 +0800</lastBuildDate><atom:link href="https://producthunt.programnotes.cn/en/tags/codebase-auditing/index.xml" rel="self" type="application/rss+xml" /><item>
        <title>improve</title>
        <link>https://producthunt.programnotes.cn/en/p/improve/</link>
        <pubDate>Wed, 11 Nov 2026 23:11:19 +0800</pubDate>
        
        <guid>https://producthunt.programnotes.cn/en/p/improve/</guid>
        <description>&lt;img src="https://images.unsplash.com/photo-1640102953836-5651f5d6b240?ixid=M3w0NjAwMjJ8MHwxfHJhbmRvbXx8fHx8fHx8fDE3OTQ0MDk3OTF8&amp;ixlib=rb-4.1.0" alt="Featured image of post improve" /&gt;&lt;h1 id=&#34;shadcnimprove&#34;&gt;&lt;a class=&#34;link&#34; href=&#34;https://github.com/shadcn/improve&#34;  target=&#34;_blank&#34; rel=&#34;noopener&#34;
    &gt;shadcn/improve&lt;/a&gt;
&lt;/h1&gt;&lt;h1 id=&#34;improve&#34;&gt;improve
&lt;/h1&gt;&lt;p&gt;An agent skill that audits any codebase and writes implementation plans for other agents to execute.&lt;/p&gt;
&lt;p&gt;The idea: use your most capable model for the part where intelligence compounds — understanding the codebase, judging what&amp;rsquo;s worth doing, writing the spec — and hand execution to cheaper models. The skill never implements anything itself. The plan is the product.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;div class=&#34;chroma&#34;&gt;
&lt;table class=&#34;lntable&#34;&gt;&lt;tr&gt;&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code&gt;&lt;span class=&#34;lnt&#34;&gt;1
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;2
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;3
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-fallback&#34; data-lang=&#34;fallback&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;you          →  /improve                    (expensive model, advises)
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;plans/       →  001-fix-n-plus-one.md       (self-contained specs)
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;other agent  →  implements, tests, ships    (cheap model, executes)
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;h2 id=&#34;install&#34;&gt;Install
&lt;/h2&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;div class=&#34;chroma&#34;&gt;
&lt;table class=&#34;lntable&#34;&gt;&lt;tr&gt;&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code&gt;&lt;span class=&#34;lnt&#34;&gt;1
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;npx skills add shadcn/improve
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;p&gt;Works in any agent that supports &lt;a class=&#34;link&#34; href=&#34;https://agentskills.io&#34;  target=&#34;_blank&#34; rel=&#34;noopener&#34;
    &gt;Agent Skills&lt;/a&gt; format. The plans it writes are plain markdown, so any agent (or human) can pick them up.&lt;/p&gt;
&lt;h2 id=&#34;usage&#34;&gt;Usage
&lt;/h2&gt;&lt;div class=&#34;highlight&#34;&gt;&lt;div class=&#34;chroma&#34;&gt;
&lt;table class=&#34;lntable&#34;&gt;&lt;tr&gt;&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code&gt;&lt;span class=&#34;lnt&#34;&gt; 1
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 2
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 3
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 4
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 5
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 6
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 7
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 8
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt; 9
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;10
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;11
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-fallback&#34; data-lang=&#34;fallback&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve                        full audit → prioritized findings → plans
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve quick                  cheap pass: hotspots, top findings only
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve deep                   exhaustive: every package, every category
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve security               focused audit (also: perf, tests, bugs, ...)
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve branch                 audit only what the current branch changes
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve next                   feature suggestions — where to take the project
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve plan &amp;lt;description&amp;gt;     skip the audit, spec one thing
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve review-plan &amp;lt;file&amp;gt;     critique and tighten an existing plan
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve execute &amp;lt;plan&amp;gt;         dispatch a cheaper executor, review its work
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve reconcile              refresh the backlog: verify, unblock, retire
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;/improve ... --issues           also publish plans as GitHub issues
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;h2 id=&#34;how-to-use&#34;&gt;How to use
&lt;/h2&gt;&lt;p&gt;A typical first run, start to finish:&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;Open your agent in the repo and run &lt;code&gt;/improve&lt;/code&gt; (or &lt;code&gt;/improve quick&lt;/code&gt; to keep it cheap).&lt;/li&gt;
&lt;li&gt;It maps the repo, audits it, and comes back with a findings table. Reply with the ones you want planned — &amp;ldquo;plan 1, 3 and 5&amp;rdquo;.&lt;/li&gt;
&lt;li&gt;Plans land in &lt;code&gt;plans/&lt;/code&gt; — one file each, plus an index with the recommended order. Read them; they&amp;rsquo;re meant to be reviewed.&lt;/li&gt;
&lt;li&gt;Hand a plan to any agent (&amp;ldquo;implement plans/001-*.md&amp;rdquo;), or let the skill run it: &lt;code&gt;/improve execute 001&lt;/code&gt;. It dispatches a cheaper model in an isolated worktree, reviews the diff against the plan, and reports back with a verdict. Merging stays up to you.&lt;/li&gt;
&lt;li&gt;Next session, run &lt;code&gt;/improve reconcile&lt;/code&gt; to clean up the backlog: verify what landed, refresh what drifted, unblock what got stuck.&lt;/li&gt;
&lt;/ol&gt;
&lt;p&gt;Before a PR, &lt;code&gt;/improve branch&lt;/code&gt; does the same thing scoped to just what your branch changes.&lt;/p&gt;
&lt;h2 id=&#34;example&#34;&gt;Example
&lt;/h2&gt;&lt;p&gt;A run against &lt;a class=&#34;link&#34; href=&#34;https://github.com/shadcn-ui/ui&#34;  target=&#34;_blank&#34; rel=&#34;noopener&#34;
    &gt;shadcn/ui&lt;/a&gt; came back with findings like:&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;div class=&#34;chroma&#34;&gt;
&lt;table class=&#34;lntable&#34;&gt;&lt;tr&gt;&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code&gt;&lt;span class=&#34;lnt&#34;&gt;1
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;2
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;3
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;4
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;5
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-fallback&#34; data-lang=&#34;fallback&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;| # | Finding                                        | Category  | Effort | Confidence |
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;|---|------------------------------------------------|-----------|--------|------------|
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;| 1 | shadow-config duplicated in search.ts/view.ts, | tech-debt | M      | HIGH       |
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;|   | copies already drifted (TODO at search.ts:31)  |           |        |            |
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;| 2 | O(n²) icon migration (migrate-icons.ts:168)    | perf      | S      | HIGH       |
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;p&gt;…and rejected a few, with reasons recorded so they don&amp;rsquo;t come back next run:&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;div class=&#34;chroma&#34;&gt;
&lt;table class=&#34;lntable&#34;&gt;&lt;tr&gt;&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code&gt;&lt;span class=&#34;lnt&#34;&gt;1
&lt;/span&gt;&lt;span class=&#34;lnt&#34;&gt;2
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class=&#34;lntd&#34;&gt;
&lt;pre tabindex=&#34;0&#34; class=&#34;chroma&#34;&gt;&lt;code class=&#34;language-gdscript3&#34; data-lang=&#34;gdscript3&#34;&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;&lt;span class=&#34;o&#34;&gt;-&lt;/span&gt; &lt;span class=&#34;p&#34;&gt;[&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;SEC&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;-&lt;/span&gt;&lt;span class=&#34;mi&#34;&gt;01&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;]&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;https_proxy&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;env&lt;/span&gt; &lt;span class=&#34;k&#34;&gt;var&lt;/span&gt; &lt;span class=&#34;s2&#34;&gt;&amp;#34;SSRF&amp;#34;&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;:&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;by&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;-&lt;/span&gt;&lt;span class=&#34;n&#34;&gt;design&lt;/span&gt; &lt;span class=&#34;err&#34;&gt;—&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;standard&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;proxy&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;convention&lt;/span&gt;&lt;span class=&#34;p&#34;&gt;,&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class=&#34;line&#34;&gt;&lt;span class=&#34;cl&#34;&gt;  &lt;span class=&#34;n&#34;&gt;every&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;CLI&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;honors&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;it&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;Not&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;a&lt;/span&gt; &lt;span class=&#34;n&#34;&gt;finding&lt;/span&gt;&lt;span class=&#34;o&#34;&gt;.&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;p&gt;Picking #1 produced &lt;a class=&#34;link&#34; href=&#34;./examples/001-extract-shadow-config-resolution.md&#34; &gt;this plan&lt;/a&gt; — current code excerpted, exact steps, the repo&amp;rsquo;s own test/lint commands as verification gates, and STOP conditions for when reality doesn&amp;rsquo;t match.&lt;/p&gt;
&lt;h2 id=&#34;how-it-works&#34;&gt;How it works
&lt;/h2&gt;&lt;p&gt;&lt;strong&gt;Recon.&lt;/strong&gt; Maps the repo: stack, conventions, and the exact build/test/lint commands — these become verification gates in every plan. It also ingests intent and design docs when present — ADRs (&lt;code&gt;docs/adr/&lt;/code&gt;), PRDs, &lt;code&gt;CONTEXT.md&lt;/code&gt;, &lt;code&gt;DESIGN.md&lt;/code&gt;, &lt;code&gt;PRODUCT.md&lt;/code&gt; — so decided tradeoffs aren&amp;rsquo;t re-flagged as findings, direction suggestions stay grounded in stated product intent, and plans speak the repo&amp;rsquo;s own vocabulary. Composes with any repo that already maintains these docs.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Audit.&lt;/strong&gt; Fans out parallel subagents across nine categories: correctness, security, performance, test coverage, tech debt, dependencies &amp;amp; migrations, DX, docs, and direction (feature suggestions — every one must cite evidence from the repo itself, no generic idea-slop). Every finding carries &lt;code&gt;file:line&lt;/code&gt; evidence, impact, effort, and confidence.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Vet.&lt;/strong&gt; Subagents over-report, so the advisor re-reads every cited location itself before showing you anything — false positives get dropped, wrong attributions get corrected, rejections get recorded.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Prioritize.&lt;/strong&gt; Findings land in a table ordered by leverage (impact ÷ effort, weighted by confidence). You pick what becomes plans.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Plan.&lt;/strong&gt; One file per selected finding, written into &lt;code&gt;plans/&lt;/code&gt; with an index, priority order, and dependency graph.&lt;/p&gt;
&lt;h2 id=&#34;what-makes-the-plans-executable&#34;&gt;What makes the plans executable
&lt;/h2&gt;&lt;p&gt;Plans are written for the weakest plausible executor — a model that has never seen the advisor session and may be much smaller. Three properties carry that:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;Self-contained.&lt;/strong&gt; All context is inlined: exact file paths, current-state code excerpts, repo conventions with an exemplar file, verified commands. No &amp;ldquo;as discussed above.&amp;rdquo;&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Verification gates.&lt;/strong&gt; Every step ends with a command and its expected output. Done criteria are machine-checkable. The executor never has to judge whether it succeeded.&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;Hard boundaries.&lt;/strong&gt; Explicit out-of-scope lists, and STOP conditions — &amp;ldquo;if X, stop and report&amp;rdquo; — instead of letting a small model improvise when reality doesn&amp;rsquo;t match the plan.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Each plan also stamps the git commit it was written against, so executors run a mechanical drift check before touching anything.&lt;/p&gt;
&lt;h2 id=&#34;closing-the-loop&#34;&gt;Closing the loop
&lt;/h2&gt;&lt;p&gt;Plans aren&amp;rsquo;t fire-and-forget:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;strong&gt;&lt;code&gt;execute &amp;lt;plan&amp;gt;&lt;/code&gt;&lt;/strong&gt; spawns a cheaper executor subagent in an isolated git worktree, hands it the plan, then reviews the result like a tech lead — re-runs every done criterion, checks scope compliance, reads the diff against intent. Verdict: approve (merging stays your call), send back for revision (max 2 rounds), or block and refine the plan.&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;&lt;code&gt;reconcile&lt;/code&gt;&lt;/strong&gt; processes what happened since: verifies DONE plans still hold, investigates BLOCKED ones and rewrites around the obstacle, refreshes drifted plans, retires findings that got fixed independently.&lt;/li&gt;
&lt;li&gt;&lt;strong&gt;&lt;code&gt;--issues&lt;/code&gt;&lt;/strong&gt; publishes plans as GitHub issues — same self-contained body, so any agent or human can pick them up where work already lives.&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;hard-rules&#34;&gt;Hard rules
&lt;/h2&gt;&lt;ul&gt;
&lt;li&gt;Never modifies source code itself. The only writes go to &lt;code&gt;plans/&lt;/code&gt;; executors edit only in disposable worktrees, and merging is always yours.&lt;/li&gt;
&lt;li&gt;Never runs commands that mutate your working tree — read, search, and read-only analysis only.&lt;/li&gt;
&lt;li&gt;Never reproduces secret values. Locations and credential types only, rotation always recommended.&lt;/li&gt;
&lt;li&gt;Asked to implement? It declines and points at the plan (or offers &lt;code&gt;execute&lt;/code&gt;).&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;license&#34;&gt;License
&lt;/h2&gt;&lt;p&gt;MIT © shadcn&lt;/p&gt;
</description>
        </item>
        
    </channel>
</rss>
