$npx -y skills add Rune-kit/rune --skill autopsyFull codebase health assessment. Use when diagnosing project health or starting a rescue workflow on legacy code — OR when evaluating an external GitHub repo for dependency / fork / contribution decisions (--external mode). Analyzes complexity, dependencies, dead code, tech debt,
| 1 | # autopsy |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | Full codebase health assessment for legacy projects. Autopsy analyzes complexity, dependency coupling, dead code, tech debt, and git hotspots to produce a health score per module and a prioritized rescue plan. Uses opus for deep analysis quality. |
| 6 | |
| 7 | ## Called By (inbound) |
| 8 | |
| 9 | - `rescue` (L1): Phase 0 RECON — assess damage before refactoring |
| 10 | - `onboard` (L2): when project appears messy during onboarding |
| 11 | - `audit` (L2): Phase 3 code quality and complexity assessment |
| 12 | - `incident` (L2): root cause analysis after containment |
| 13 | |
| 14 | ## Calls (outbound) |
| 15 | |
| 16 | - `scout` (L2): deep structural scan — files, LOC, entry points, imports |
| 17 | - `research` (L3): identify if tech stack is outdated |
| 18 | - `trend-scout` (L3): compare against current best practices |
| 19 | - `journal` (L3): record health assessment findings |
| 20 | |
| 21 | ## Execution Steps |
| 22 | |
| 23 | ### Step 0 — Repo intelligence (if GitHub-hosted) |
| 24 | |
| 25 | If the project is a GitHub repository, gather repo-level metrics before diving into code: |
| 26 | |
| 27 | ```bash |
| 28 | # Fetch via GitHub API (requires gh CLI or curl + GITHUB_TOKEN) |
| 29 | gh api repos/{owner}/{repo} --jq '{stars: .stargazers_count, forks: .forks_count, open_issues: .open_issues_count, license: .license.spdx_id, language: .language, topics: .topics, created: .created_at, pushed: .pushed_at}' |
| 30 | |
| 31 | # Contributor count and top contributors |
| 32 | gh api repos/{owner}/{repo}/contributors --jq 'length' |
| 33 | gh api repos/{owner}/{repo}/contributors --jq '.[0:5] | .[] | "\(.login): \(.contributions)"' |
| 34 | |
| 35 | # Commit frequency (last 52 weeks) |
| 36 | gh api repos/{owner}/{repo}/stats/commit_activity --jq '[.[] | .total] | add' |
| 37 | |
| 38 | # Language byte distribution |
| 39 | gh api repos/{owner}/{repo}/languages |
| 40 | ``` |
| 41 | |
| 42 | Record in working notes: |
| 43 | - **Activity signal**: commits/week (>5 = active, 1-5 = maintained, <1 = stale) |
| 44 | - **Bus factor**: contributor count (1 = critical risk, 2-3 = low, >5 = healthy) |
| 45 | - **Community signal**: stars/forks ratio, open issue count, staleness of latest push |
| 46 | |
| 47 | Skip this step for local-only projects with no remote. |
| 48 | |
| 49 | ### Step 1 — Structure scan |
| 50 | |
| 51 | Call `rune:scout` with a request for a full project map. Ask scout to return: |
| 52 | - All source files with LOC counts |
| 53 | - Entry points and main modules |
| 54 | - Import/dependency graph (who imports who) |
| 55 | - Test files and their coverage targets |
| 56 | - Config files (tsconfig, eslint, package.json, etc.) |
| 57 | |
| 58 | ### Step 2 — Module analysis |
| 59 | |
| 60 | For each major module identified by scout, use `Read` to open the file and assess: |
| 61 | - LOC (flag anything over 500 as a god file) |
| 62 | - Function count and average function length |
| 63 | - Maximum nesting depth (flag > 4 levels) |
| 64 | - Cyclomatic complexity signals (deep conditionals, many branches) |
| 65 | - Test file presence and estimated coverage |
| 66 | |
| 67 | Record findings per module in a working table. |
| 68 | |
| 69 | ### Step 3 — Health scoring |
| 70 | |
| 71 | Score each module 0-100 across six dimensions: |
| 72 | |
| 73 | | Dimension | Weight | Scoring criteria | |
| 74 | |---|---|---| |
| 75 | | Complexity | 20% | Cyclomatic < 5 = 100, 5-10 = 70, 10-20 = 40, > 20 = 0 | |
| 76 | | Test coverage | 25% | > 80% = 100, 50-80% = 60, 20-50% = 30, < 20% = 0 | |
| 77 | | Documentation | 15% | README + inline comments = 100, partial = 50, none = 0 | |
| 78 | | Dependencies | 20% | Low coupling = 100, medium = 60, high/circular = 0 | |
| 79 | | Code smells | 10% | No god files, no deep nesting = 100, each violation -20 | |
| 80 | | Maintenance | 10% | Regular commits = 100, stale > 6 months = 50, untouched > 1yr = 0 | |
| 81 | |
| 82 | Compute weighted score per module. Assign risk tier: |
| 83 | - 80-100 = healthy (green) |
| 84 | - 60-79 = watch (yellow) |
| 85 | - 40-59 = at-risk (orange) |
| 86 | - 0-39 = critical (red) |
| 87 | |
| 88 | ### Step 4 — Risk assessment |
| 89 | |
| 90 | Use `Bash` to gather git archaeology data: |
| 91 | |
| 92 | ```bash |
| 93 | # Most changed files (hotspots) |
| 94 | git log --format=format: --name-only | sort | uniq -c | sort -rg | head -20 |
| 95 | |
| 96 | # Files not touched in over a year |
| 97 | git log --before="1 year ago" --format="%H" | head -1 | xargs -I{} git diff --name-only {}..HEAD |
| 98 | |
| 99 | # Authors per file (high author count = high churn risk) |
| 100 | git log --format="%an" -- <file> | sort -u | wc -l |
| 101 | |
| 102 | # Commit velocity by month (trend detection) |
| 103 | git log --format="%Y-%m" | sort | uniq -c | tail -12 |
| 104 | |
| 105 | # Issue/PR close rate (GitHub only) |
| 106 | gh api repos/{owner}/{repo}/issues --jq '[.[] | select(.pull_request == null)] | length' |
| 107 | ``` |
| 108 | |
| 109 | Identify: |
| 110 | - Circular dependencies (A imports B, B imports A) |
| 111 | - God files (> 500 LOC with many importers) |
| 112 | - Hotspot files (changed most often = highest bug density) |
| 113 | - Dead files (no importers, no recent commits) |
| 114 | - Velocity trend: accelerating, stable, or decelerating (compare last 3 months) |
| 115 | |
| 116 | ### Step 5 — Generate RESCUE-REPORT.md |
| 117 | |
| 118 | Use `Write` to save `RESCUE-REPORT.md` at the |