skills.rest
YYG501
YYG501COMMUNITY
Explore all skills by this author →
GitHub

pmai-internal-codebase-audit

Audits existing codebases across seven dimensions to produce a PM-confirmed current-state document.

4|Updated May 26, 2026
Search Tags:#onboarding#brownfield#codebase audit#secret redaction#current state#pmai#product baseline
One-click install
npx skills add https://github.com/YYG501/PM-AI-Harness --skill pmai-internal-codebase-audit-yyg501
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pmai-internal-codebase-audit
Source: https://github.com/YYG501/PM-AI-Harness/tree/main/skills/_internal/codebase-audit
Command: npx skills add https://github.com/YYG501/PM-AI-Harness --skill pmai-internal-codebase-audit-yyg501

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When onboarding an existing (brownfield) codebase into the PMAI product workflow, teams lack a verified snapshot of what the code actually does. This Skill scans the repository and produces a confirmed current-state record without inventing product direction from code. ## Core Features & Use Cases - Seven-Dimension Scan: Inventories tech stack, external integrations, architecture, directory structure, code conventions, test coverage, and risks into docs/CODEBASE-AUDIT.md. - Secret Protection: Redacts keys, tokens, and connection strings during scanning, recording only existence and location of sensitive files. - Baseline Verification: Checks whether pre-existing product materials form an equivalent product baseline, routing to design or proposal accordingly. - Use Case: A PM points PMAI at a legacy repository; the Skill audits the code, confirms a module inventory with the PM, bootstraps PRODUCT-STATE.md, and decides whether the project can skip straight to module design. ## Quick Start Run /pmai-init-project in a directory containing an existing codebase and confirm the audit scope when prompted.

Frequently Asked Questions about pmai-internal-codebase-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit an existing codebase before starting product design?▼

Run /pmai-init-project in the repository root; when it detects existing source code it automatically enters this audit subflow. The scan produces docs/CODEBASE-AUDIT.md covering seven dimensions, which the PM confirms before baseline verification.

What does the codebase audit scan cover?▼

The audit covers seven dimensions: tech stack and versions, external integrations, architecture shape, directory structure, code conventions, test status, and risks including suspected hardcoded secrets. Results are written to docs/CODEBASE-AUDIT.md using a fixed template.

Does the codebase audit expose secrets or credentials?▼

No. Secret protection is a hard constraint: any key, token, password, or connection string found during scanning is replaced with a redacted placeholder. Sensitive files like .env or .pem are recorded only by existence and purpose, never by content.

Can the audit generate product specs from existing code?▼

No. Code serves only as evidence of current state. The audit never generates or rewrites target spec.md files, never infers product direction from code, and routes product-level gaps to /pmai-proposal instead of answering them with questionnaires.

When should I not use the codebase audit subflow?▼

Skip it for greenfield projects with no existing code; /pmai-init-project handles those directly. It is also not a standalone public command and should only be reached through the init entry point, including for rescanning after interruption.

Related Skills

Explore More Product & Management Skills→
ybbms777ybbms777
4

cache-monitor

Hash static workspace files with SHA-256 and warn on changes via CLI.

Community
Intermediate
Negentropy-LabyNegentropy-Laby
3

team-level

Orchestrate subagents and approval gates for area and workflow design.

Official
Advanced
AvatarGanymedeAvatarGanymede

record

Records architectural decisions and synchronizes corresponding product specification updates during development conversations.

Community
Intermediate
tjisousatjisousa

go

Detect project state and propose the next GSE-One action from YAML files.

Community
Advanced