slop-scan
Scan a codebase for accumulated slop, technical debt, dead code, and refactor opportunities. Use when user says 'scan for slop', 'find tech debt', 'what needs cleanup', or before a refactor sprint.
Best use case
slop-scan is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Scan a codebase for accumulated slop, technical debt, dead code, and refactor opportunities. Use when user says 'scan for slop', 'find tech debt', 'what needs cleanup', or before a refactor sprint.
Teams using slop-scan should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/slop-scan/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How slop-scan Compares
| Feature / Agent | slop-scan | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Scan a codebase for accumulated slop, technical debt, dead code, and refactor opportunities. Use when user says 'scan for slop', 'find tech debt', 'what needs cleanup', or before a refactor sprint.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# /slop-scan — Detect Technical Debt ## Usage ``` /slop-scan # full project scan /slop-scan src/ # specific directory /slop-scan --quick # top issues only ``` ## What It Detects 1. **Code smells**: functions >50 lines, files >500 lines, nesting >3 levels 2. **Duplication**: copy-pasted blocks, repeated patterns 3. **Dead code**: unused functions, commented-out code >10 lines, unused imports 4. **Tech debt**: old TODOs, deprecated APIs, outdated deps 5. **Anti-patterns**: magic numbers, tight coupling, missing error handling 6. **AI slop**: over-abstraction, unnecessary helpers, verbose comments on obvious code ## Process 1. List files by type (exclude node_modules, .git, vendor) 2. Prioritize most-changed files (`git log --format=%H -- FILE | wc -l`) 3. Grep for patterns (TODO, FIXME, unused, deprecated) 4. Read top hotspot files for deeper analysis 5. Score and rank by impact ## Output ```markdown ## Slop Report: [project] **Slop Level**: Low/Medium/High **Files scanned**: X | **Issues**: Y ### Critical (fix now) | Issue | Location | Effort | |-------|----------|--------| ### Quick Wins (low effort, high impact) - [list with estimated time] ### Deep Refactors (plan for sprint) - [list with estimated time] ### Hotspots (most problematic files) 1. file.ts — X issues ``` ## Decision Rules - High (>30 issues): pause features, refactor sprint - Medium (10-30): weekly cleanup sessions - Low (<10): maintenance mode
Related Skills
overseer
Adversarial review of PRs and diffs before merge. Use when finishing a PR, before merging to main, or user says 'review this diff', 'check this PR', 'is this ready to merge'. Detects slop, security issues, inconsistencies.
forge
Full dev pipeline: scan, plan, execute, review, ship. Use when user says /forge or wants the full quality pipeline on a task. Don't use for quick fixes (<25 LOC) or docs-only changes.
scanpy
Scalable toolkit for analyzing single-cell gene expression data. Built on top of Anndata, focusing on clustering, trajectory inference, and visualization.
thor-scan
Run THOR scans and propose the exact command line for Windows, Linux, or macOS. Use when the user wants to scan a host, a directory, a mounted image, or a memory dump with THOR v10/v11.
scanning-network-with-nmap-advanced
使用 Nmap 的脚本引擎、时序控制、规避技术和输出解析，对授权目标网络执行高级网络侦察， 发现主机、枚举服务、检测漏洞并识别操作系统。
scanning-kubernetes-manifests-with-kubesec
使用 Kubesec 对 Kubernetes 资源清单执行安全风险分析，识别错误配置、权限提升风险以及与安全最佳实践的偏差。
scanning-infrastructure-with-nessus
Tenable Nessus 是业界领先的漏洞扫描器，用于识别网络基础设施（包括服务器、工作站、网络设备和操作系统）中的安全弱点。
scanning-docker-images-with-trivy
Trivy 是 Aqua Security 开源的综合性漏洞扫描器，用于检测容器镜像中操作系统软件包、语言特定依赖项的漏洞、错误配置、密钥和许可证违规，并集成到 CI/CD 流水线，支持 SARIF、CycloneDX 和 SPDX 等多种输出格式。
scanning-containers-with-trivy-in-cicd
本技能涵盖将 Aqua Security 的 Trivy 扫描器集成到 CI/CD 流水线中，用于全面的容器镜像漏洞检测。包括扫描 Docker 镜像中的操作系统包和应用依赖 CVE、检测 Dockerfile 中的错误配置、扫描文件系统和 Git 仓库，以及建立基于严重性的质量门禁以阻止有漏洞的镜像部署。
scanning-container-images-with-grype
使用 Anchore Grype 扫描容器镜像的已知漏洞（Vulnerability），支持基于 SBOM 的匹配和可配置的严重性阈值。
performing-web-application-scanning-with-nikto
Nikto 是一款开源 Web 服务器和 Web 应用程序扫描器，可针对超过 7,000 个潜在危险文件/程序进行测试，检查超过 1,250 个服务器的过期版本，并识别超过 270 个服务器的版本特定问题。
performing-vulnerability-scanning-with-nessus
使用 Tenable Nessus 执行认证和未认证漏洞扫描，识别网络基础设施、服务器和应用程序中的已知漏洞、 错误配置、默认凭据和缺失补丁。扫描器将发现与 CVE 数据库和 CVSS 评分关联，生成优先级修复指导。 适用于漏洞扫描、Nessus 评估、补丁合规检查或自动化漏洞检测等请求场景。