Project Discovery | 專案現況評估
Phase 0 assessment before adding features to existing codebases. Evaluate project health, architecture, and risks.
在既有程式碼庫新增功能前的 Phase 0 評估。評估專案健康度、架構與風險。
Assessment Dimensions | 評估維度
| Dimension |
What to Check |
檢查項目 |
| Architecture |
Module structure, dependency graph, entry points |
模組結構、相依圖、進入點 |
| Dependencies |
Outdated packages, known vulnerabilities, license risks |
過時套件、已知漏洞、授權風險 |
| Test Coverage |
Existing test suite, coverage gaps, test quality |
現有測試、覆蓋率缺口、測試品質 |
| Security |
npm audit findings, hardcoded secrets, exposed endpoints |
安全稽核、硬編碼密鑰、暴露端點 |
| Technical Debt |
TODOs, code duplication, complexity hotspots |
TODO 標記、程式碼重複、複雜度熱點 |
Workflow | 工作流程
- Scan project - Read package.json, directory structure, config files
- Analyze architecture - Map modules, dependencies, and data flow
- Check dependencies - Run
npm outdated, npm audit for health signals
- Assess risks - Identify complexity hotspots, missing tests, security issues
- Generate report - Output health score with actionable recommendations
Output Format | 輸出格式
Project Health Report
=====================
Overall Score: 7.2 / 10
| Dimension | Score | Status | Key Finding |
|-----------------|-------|---------|------------------------|
| Architecture | 8/10 | Good | Clean module boundaries |
| Dependencies | 6/10 | Warning | 5 outdated, 1 critical |
| Test Coverage | 7/10 | Fair | 72% line coverage |
| Security | 8/10 | Good | No critical vulns |
| Technical Debt | 6/10 | Warning | 23 TODOs, 3 hotspots |
Recommendations:
1. [HIGH] Update lodash to fix CVE-2024-XXXX
2. [MED] Add tests for src/payments/ (0% coverage)
3. [LOW] Resolve TODO backlog in src/utils/
Risk Register | 風險登記簿
After assessment, identified risks are recorded in a structured Risk Register for ongoing tracking.
評估完成後，已識別的風險記錄在結構化的風險登記簿中進行持續追蹤。
Risk Matrix | 風險矩陣
Impact | 影響
Low Med High
High [ Med ] [High] [Crit]
Med [ Low ] [Med ] [High] Likelihood | 可能性
Low [ Low ] [Low ] [Med ]
Risk Register Template | 風險登記簿模板
# Risk Register — [Project Name]
**Last Updated**: YYYY-MM-DD
| ID | Category | Description | Likelihood | Impact | Level | Owner | Mitigation | Status |
|----|----------|-------------|-----------|--------|-------|-------|------------|--------|
| RISK-001 | Security | Outdated deps with CVEs | High | High | Critical | @dev | npm audit fix | Open |
| RISK-002 | Performance | No load testing | Medium | High | High | @ops | Add k6 tests | Open |
| RISK-003 | Quality | Low test coverage in payments | High | Medium | High | @qa | Add IT tests | Mitigating |
Risk Status Lifecycle | 風險狀態
Identified ──► Mitigating ──► Resolved ──► Closed
│
└──► Accepted (with justification)
Risk Storage | 風險存放
docs/risks/
├── RISK-REGISTER.md # Active risk register
├── RISK-REGISTER-2026-Q1.md # Quarterly snapshot (optional)
└── README.md # Index
Usage | 使用方式
/discover - Full project health assessment/discover auth - Focused assessment of auth-related modules/discover payments - Assess risks before adding payment features/discover --risks - View current risk register/discover --update-risk RISK-NNN - Update a risk item status
Next Steps Guidance | 下一步引導
After /discover completes, the AI assistant should suggest based on the assessment:
根據評估結果，建議下一步 / Based on assessment, suggested next steps:
- New feature / 新功能 →
/sdd to create a specification ⭐ Recommended / 推薦
- Legacy code / 遺留程式碼 →
/reverse spec to extract existing behavior
- Refactoring / 重構 →
/refactor decide to choose a strategy
- Quick fix / 快速修復 →
/tdd to write a targeted test and fix
- Risk tracking / 風險追蹤 →
/discover --risks to view risk register
- Architecture decision / 架構決策 →
/adr to record decisions made during discovery
Reference | 參考
- Step-by-step workflow: workflow.md — the discovery steps in order (code health, architecture, documentation inventory, review snapshot, dependency and security). Read it when actually running a discovery rather than deciding whether to.
- Detailed guide: guide.md
AI Agent Behavior | AI 代理行為
完整的 AI 行為定義請參閱對應的命令文件：/discover
For complete AI agent behavior definition, see the corresponding command file: /discover
1---2name: discover3scope: universal4description: |5 [UDS] Assess project health, architecture, and risks before adding features to an existing codebase.6 Use when: onboarding to an unfamiliar or legacy project, sizing risk before starting a feature, building a risk register.7 Not for: ongoing metric tracking on a codebase you already know — use /metrics; recovering specs from code — use /reverse.8 Keywords: discovery, project assessment, legacy onboarding, risk register, technical debt, 現況評估, 專案盤點, 風險登記簿.9allowed-tools: Read, Grep, Glob, Bash(npm test:*), Bash(npm audit:*), Bash(npm outdated:*)10argument-hint: "[feature area | 功能範圍]"11status: stable12# 2026-08-18: `disable-model-invocation: true` removed, and a status recorded.13#14# The flag was applied by d415937e alongside the description rewrite and, like15# the two lifted on 2026-08-17, followed no stateable rule. These eight were16# left alone that day for a reason that was correct at the time: the rule17# settled on was "a reference is model-invocable", and none of them carried a18# `status` at all, so lifting them would have replaced one unruled state with19# one unruled action.20#21# Measured 2026-08-18, which is what closed it: all eight carry a full22# `Use when:` trigger and a `Not for:` exclusion, all eight describe an action23# rather than reference material, and all eight already have a slash command —24# which is exactly the shape of `code-review-assistant`, whose paired `/code-review`25# was ruled not to justify the flag. `journey-test-assistant` is the standing26# precedent: same "Generate X" shape, `status: stable`, never disabled.27#28# `stable` rather than a new value: `skills/` uses reference, stable and29# experimental, and inventing a fourth would be the same unruled-action mistake30# in different clothing.31#32# The cost of being wrong is asymmetric and observable in only one direction.33# Over-triggering shows up and is undone by deleting a line; a skill that is34# structurally unable to fire produces no signal at all. (XSPEC-378 R5)35---3637# Project Discovery | 專案現況評估3839Phase 0 assessment before adding features to existing codebases. Evaluate project health, architecture, and risks.4041在既有程式碼庫新增功能前的 Phase 0 評估。評估專案健康度、架構與風險。4243## Assessment Dimensions | 評估維度4445| Dimension | What to Check | 檢查項目 |46|-----------|--------------|----------|47| **Architecture** | Module structure, dependency graph, entry points | 模組結構、相依圖、進入點 |48| **Dependencies** | Outdated packages, known vulnerabilities, license risks | 過時套件、已知漏洞、授權風險 |49| **Test Coverage** | Existing test suite, coverage gaps, test quality | 現有測試、覆蓋率缺口、測試品質 |50| **Security** | `npm audit` findings, hardcoded secrets, exposed endpoints | 安全稽核、硬編碼密鑰、暴露端點 |51| **Technical Debt** | TODOs, code duplication, complexity hotspots | TODO 標記、程式碼重複、複雜度熱點 |5253## Workflow | 工作流程54551. **Scan project** - Read package.json, directory structure, config files562. **Analyze architecture** - Map modules, dependencies, and data flow573. **Check dependencies** - Run `npm outdated`, `npm audit` for health signals584. **Assess risks** - Identify complexity hotspots, missing tests, security issues595. **Generate report** - Output health score with actionable recommendations6061## Output Format | 輸出格式6263```64Project Health Report65=====================66Overall Score: 7.2 / 106768| Dimension | Score | Status | Key Finding |69|-----------------|-------|---------|------------------------|70| Architecture | 8/10 | Good | Clean module boundaries |71| Dependencies | 6/10 | Warning | 5 outdated, 1 critical |72| Test Coverage | 7/10 | Fair | 72% line coverage |73| Security | 8/10 | Good | No critical vulns |74| Technical Debt | 6/10 | Warning | 23 TODOs, 3 hotspots |7576Recommendations:771. [HIGH] Update lodash to fix CVE-2024-XXXX782. [MED] Add tests for src/payments/ (0% coverage)793. [LOW] Resolve TODO backlog in src/utils/80```8182## Risk Register | 風險登記簿8384After assessment, identified risks are recorded in a structured Risk Register for ongoing tracking.8586評估完成後，已識別的風險記錄在結構化的風險登記簿中進行持續追蹤。8788### Risk Matrix | 風險矩陣8990```91 Impact | 影響92 Low Med High93High [ Med ] [High] [Crit]94Med [ Low ] [Med ] [High] Likelihood | 可能性95Low [ Low ] [Low ] [Med ]96```9798### Risk Register Template | 風險登記簿模板99100```markdown101# Risk Register — [Project Name]102**Last Updated**: YYYY-MM-DD103104| ID | Category | Description | Likelihood | Impact | Level | Owner | Mitigation | Status |105|----|----------|-------------|-----------|--------|-------|-------|------------|--------|106| RISK-001 | Security | Outdated deps with CVEs | High | High | Critical | @dev | npm audit fix | Open |107| RISK-002 | Performance | No load testing | Medium | High | High | @ops | Add k6 tests | Open |108| RISK-003 | Quality | Low test coverage in payments | High | Medium | High | @qa | Add IT tests | Mitigating |109```110111### Risk Status Lifecycle | 風險狀態112113```114Identified ──► Mitigating ──► Resolved ──► Closed115 │116 └──► Accepted (with justification)117```118119### Risk Storage | 風險存放120121```122docs/risks/123├── RISK-REGISTER.md # Active risk register124├── RISK-REGISTER-2026-Q1.md # Quarterly snapshot (optional)125└── README.md # Index126```127128## Usage | 使用方式129130- `/discover` - Full project health assessment131- `/discover auth` - Focused assessment of auth-related modules132- `/discover payments` - Assess risks before adding payment features133- `/discover --risks` - View current risk register134- `/discover --update-risk RISK-NNN` - Update a risk item status135136## Next Steps Guidance | 下一步引導137138After `/discover` completes, the AI assistant should suggest based on the assessment:139140> **根據評估結果，建議下一步 / Based on assessment, suggested next steps:**141> - **New feature / 新功能** → `/sdd` to create a specification ⭐ **Recommended / 推薦**142> - **Legacy code / 遺留程式碼** → `/reverse spec` to extract existing behavior143> - **Refactoring / 重構** → `/refactor decide` to choose a strategy144> - **Quick fix / 快速修復** → `/tdd` to write a targeted test and fix145> - **Risk tracking / 風險追蹤** → `/discover --risks` to view risk register146> - **Architecture decision / 架構決策** → `/adr` to record decisions made during discovery147148## Reference | 參考149150- Step-by-step workflow: [workflow.md](./workflow.md) — the discovery steps in order (code health, architecture, documentation inventory, review snapshot, dependency and security). Read it when actually running a discovery rather than deciding whether to.151- Detailed guide: [guide.md](./guide.md)152153154## AI Agent Behavior | AI 代理行為155156> 完整的 AI 行為定義請參閱對應的命令文件：[`/discover`](../commands/discover.md#ai-agent-behavior--ai-代理行為)157>158> For complete AI agent behavior definition, see the corresponding command file: [`/discover`](../commands/discover.md#ai-agent-behavior--ai-代理行為)
AsiaOstrich