Codebase Slop Audit
Audit code quality with search metrics.
Counts guide inspection.
Evidence decides findings.
Flow
- Search source files with generated, build, vendor, and lock files excluded.
- Count broad sloppy-code signals.
- Rank files by repeated signals.
- Inspect the top files before judging.
- Report investigated findings.
- Ask the user how to handle the findings before editing.
- Use TEMPLATE.md for output.
Scan
Use rg.
Start with this pattern, then narrow by repo language and folders:
rg -n "isRecord|Record<string,\s*(unknown|any)>|\bfallback\b|fallback[A-Z]|return\s+(null|undefined)|===?\s*(null|undefined)|!==?\s*(null|undefined)|\?\?|\?\.|[A-Za-z0-9_\)\]]!|\bas\s+(any|unknown|Record<)|:\s*any\b|from\s+['\"]node:|import\(['\"]node:|catch\s*\(|console\.(error|warn)|TODO|FIXME|HACK|workaround" . \
--glob '*.{ts,tsx,js,jsx,astro,vue,svelte}' \
--glob '!node_modules/**' \
--glob '!dist/**' \
--glob '!build/**' \
--glob '!coverage/**' \
--glob '!**/generated/**' \
--glob '!**/*.generated.*' \
--glob '!*.lock'
Rank hotspot files:
rg -n "isRecord|Record<string,\s*(unknown|any)>|\bfallback\b|===?\s*(null|undefined)|!==?\s*(null|undefined)|\?\?|\?\.|\bas\s+(any|unknown)|:\s*any\b|from\s+['\"]node:|import\(['\"]node:|TODO|FIXME|HACK|workaround" . \
| cut -d: -f1 \
| sort \
| uniq -c \
| sort -nr \
| head -20
Signals
isRecord, Record<string, unknown>, or Record<string, any>.- Fallbacks, default objects,
return null, or return undefined.
- Repeated null or undefined guards, optional chaining, or nullish coalescing.
- Non-null assertions.
as any, broad as Type, assertion chains, or : any.node:* imports outside scripts, config, CLI, build-time, or server-only files.- Swallowed errors, generic errors,
console.error, or console.warn.
TODO, FIXME, HACK, temporary, or workaround.
Judgment
Valid:
- Boundary code parses external JSON, CMS, API, DB, file, env, URL, or message data.
- Code narrows once, normalizes once, and gives the app a typed shape.
- Optional data is truly optional and does not hide a required invariant.
node:* imports stay in server-only or build-time code.
Sloppy:
- Guards, fallbacks, or assertions repeat inside domain, UI, or business logic.
- Missing required data becomes empty arrays, default objects,
null, or undefined.
- Type escapes replace runtime validation.
node:* imports can reach browser bundles or shared frontend modules.- Error handling drops cause, context, or user-visible failure.
1---2name: codebase-slop-audit3description: Detect sloppy-code signals with repo-wide search metrics and sampled evidence. Use when asked to audit codebase quality, "vibe coding", `isRecord`, broad `Record<string, unknown>` guards, fallback usage, excessive null guards, non-null assertions, unsafe type assertions, `node:*` imports in browser/shared code, swallowed errors, TODO debt, or code smell hotspots before refactoring.4---56# Codebase Slop Audit78Audit code quality with search metrics.9Counts guide inspection.10Evidence decides findings.1112## Flow13141. Search source files with generated, build, vendor, and lock files excluded.152. Count broad sloppy-code signals.163. Rank files by repeated signals.174. Inspect the top files before judging.185. Report investigated findings.196. Ask the user how to handle the findings before editing.207. Use [TEMPLATE.md](TEMPLATE.md) for output.2122## Scan2324Use `rg`.25Start with this pattern, then narrow by repo language and folders:2627```bash28rg -n "isRecord|Record<string,\s*(unknown|any)>|\bfallback\b|fallback[A-Z]|return\s+(null|undefined)|===?\s*(null|undefined)|!==?\s*(null|undefined)|\?\?|\?\.|[A-Za-z0-9_\)\]]!|\bas\s+(any|unknown|Record<)|:\s*any\b|from\s+['\"]node:|import\(['\"]node:|catch\s*\(|console\.(error|warn)|TODO|FIXME|HACK|workaround" . \29 --glob '*.{ts,tsx,js,jsx,astro,vue,svelte}' \30 --glob '!node_modules/**' \31 --glob '!dist/**' \32 --glob '!build/**' \33 --glob '!coverage/**' \34 --glob '!**/generated/**' \35 --glob '!**/*.generated.*' \36 --glob '!*.lock'37```3839Rank hotspot files:4041```bash42rg -n "isRecord|Record<string,\s*(unknown|any)>|\bfallback\b|===?\s*(null|undefined)|!==?\s*(null|undefined)|\?\?|\?\.|\bas\s+(any|unknown)|:\s*any\b|from\s+['\"]node:|import\(['\"]node:|TODO|FIXME|HACK|workaround" . \43 | cut -d: -f1 \44 | sort \45 | uniq -c \46 | sort -nr \47 | head -2048```4950## Signals5152- `isRecord`, `Record<string, unknown>`, or `Record<string, any>`.53- Fallbacks, default objects, `return null`, or `return undefined`.54- Repeated null or undefined guards, optional chaining, or nullish coalescing.55- Non-null assertions.56- `as any`, broad `as Type`, assertion chains, or `: any`.57- `node:*` imports outside scripts, config, CLI, build-time, or server-only files.58- Swallowed errors, generic errors, `console.error`, or `console.warn`.59- `TODO`, `FIXME`, `HACK`, `temporary`, or `workaround`.6061## Judgment6263Valid:6465- Boundary code parses external JSON, CMS, API, DB, file, env, URL, or message data.66- Code narrows once, normalizes once, and gives the app a typed shape.67- Optional data is truly optional and does not hide a required invariant.68- `node:*` imports stay in server-only or build-time code.6970Sloppy:7172- Guards, fallbacks, or assertions repeat inside domain, UI, or business logic.73- Missing required data becomes empty arrays, default objects, `null`, or `undefined`.74- Type escapes replace runtime validation.75- `node:*` imports can reach browser bundles or shared frontend modules.76- Error handling drops cause, context, or user-visible failure.
flpbalada