# 07 Refactor

> Improve code across four axes (cleanup, performance, security, architecture) by scanning and fixing, or applying a pushed audit report. Use when the user wants to refactor, optimize, harden, or remove code. Not for read-only diagnosis or adding tests.

- Skill: `ai-driven-dev/07-refactor` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add ai-driven-dev/07-refactor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ai-driven-dev/07-refactor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ai-driven-dev (https://skillmd.com/u/ai-driven-dev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ai-driven-dev/07-refactor

---


# Skill: refactor

The act-side of code improvement: it changes code to make it better. Behavior-preserving for cleanup, performance, and architecture; security may change behavior on purpose to close a hole.

## Actions

| #   | Action         | Axis         | Lens                                                       |
| --- | -------------- | ------------ | ---------------------------------------------------------- |
| 01  | `performance`  | performance  | N+1, hot paths, batching, memoization, unnecessary I/O      |
| 02  | `security`     | security     | OWASP, input validation, authz, secrets: harden and fix    |
| 03  | `cleanup`      | code-quality | clean code: rename, extract, DRY, dead code, complexity     |
| 04  | `architecture` | architecture | extract layers, fix coupling, enforce boundaries            |

Run the one axis named, or offer all applicable when the request is unscoped.
Before running an action, read its file in `actions/`, not only the table or assets.

## Transversal rules

- Scope: run the one named axis, or for an unscoped request ask once "all applicable axes, or one?" before running. A request to delete or remove code runs `cleanup` directly, with no axis question. Never silently default to one axis.
- Behavior-preserving for cleanup, performance, and architecture: public inputs and outputs stay identical, verified by tests, type checks, or a side-by-side run. Security may alter behavior to close a vulnerability, and must call that out explicitly.
- Audit-fed, optional: when the caller pushes an audit report (a path under `aidd_docs/tasks/audits/` or pasted findings), take its findings for this axis as the fix list and skip the scan. The bridge is the report artifact; this skill never loads or calls another skill. The audit `code-quality` pillar feeds the `cleanup` axis; the other axes map by name.
- Severity uses the shared 3-level scale: 🔴 critical, 🟡 warning, 🟢 minor.
- Stay inside the axis: dependency upgrades and UI redesign are out of scope. Add tests only as a regression for a security fix, never otherwise.