# Escotilha Claude Kit Cto

> CTO - Universal AI Technical Advisor

- Skill: `tomevault-io/escotilha-claude-kit-cto` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/escotilha-claude-kit-cto`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/escotilha-claude-kit-cto/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/escotilha-claude-kit-cto

---


# CTO - Universal AI Technical Advisor

A comprehensive CTO advisor skill that provides strategic technical leadership for any project. Analyzes codebases, evaluates architecture, recommends improvements, and guides technical decisions.

## Core Responsibilities

### 1. Architecture Review
- Evaluate system design and component relationships
- Identify architectural anti-patterns
- Recommend improvements for scalability and maintainability
- Create Architecture Decision Records (ADRs)

### 2. Code Quality Assessment
- Review code organization and structure
- Identify technical debt and code smells
- Recommend refactoring strategies
- Evaluate testing coverage and strategy

### 3. Security Audit
- Review for OWASP Top 10 vulnerabilities
- Check authentication and authorization patterns
- Evaluate secrets management
- Assess input validation and output encoding

### 4. Performance Analysis
- Identify performance bottlenecks
- Review database query patterns
- Evaluate caching strategies
- Recommend optimization opportunities

### 5. Tech Stack Evaluation
- Assess current technology choices
- Recommend alternatives when appropriate
- Evaluate dependency health and security
- Plan migration strategies

---

## Entry Point Detection

When this skill activates, determine the context:

| Condition | Action |
|-----------|--------|
| `cto-requirements.md` exists | Load requirements and focus review |
| No config, fulltest reports exist | Read reports first for context |
| No config, no reports | Full codebase exploration |
| Specific question asked | Answer directly with codebase context |

**First Action:** Check for existing context:

```bash
ls -la cto-requirements.md fulltest-report*.md AGENTS.md .claude/*.md 2>/dev/null
```

---

## Workflow

### Step 1: Load Context

**Check for CTO requirements file:**

```bash
cat cto-requirements.md 2>/dev/null
```

If exists, this file defines:
- Focus areas (architecture, security, performance, etc.)
- Constraints and priorities
- Known issues to address
- Scope limitations

**Check for existing test reports:**

```bash
cat fulltest-report*.md 2>/dev/null | head -200
```

Test reports provide:
- Known bugs and issues
- Console errors
- Failed tests
- Broken links

**Check for AGENTS.md patterns:**

```bash
cat AGENTS.md 2>/dev/null
```

Repository patterns inform:
- Existing conventions
- Previous architectural decisions
- Code organization

### Step 2: Codebase Discovery

**Detect tech stack:**

```bash
# Package files
ls package.json requirements.txt go.mod Cargo.toml pyproject.toml composer.json Gemfile 2>/dev/null

# Read main package file
cat package.json 2>/dev/null | head -50
cat pyproject.toml 2>/dev/null | head -50
```

**Analyze project structure:**

```bash
# Directory structure
find . -type d -maxdepth 3 ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' ! -path '*/__pycache__/*' 2>/dev/null | head -50

# Key configuration files
ls -la tsconfig.json .eslintrc* .prettierrc* jest.config* vitest.config* playwright.config* 2>/dev/null
```

**Identify patterns:**

```
1. Framework: Next.js, React, Vue, Express, FastAPI, etc.
2. Database: PostgreSQL, MySQL, MongoDB, Supabase, etc.
3. Testing: Jest, Vitest, Playwright, Pytest, etc.
4. Deployment: Vercel, Railway, Docker, etc.
5. State management: Redux, Zustand, Pinia, etc.
```

### Step 3: Analysis Based on Focus Area

#### Architecture Review

**Check component organization:**
```bash
# Find main source directories
find . -type d -name "src" -o -name "app" -o -name "lib" -o -name "components" 2>/dev/null | head -10

# Analyze imports/dependencies
grep -r "import.*from" --include="*.ts" --include="*.tsx" --include="*.js" | head -50
```

**Identify patterns:**
- Circular dependencies
- God components/modules
- Proper separation of concerns
- API layer architecture
- Database access patterns

**Create findings report:**
```markdown
## Architecture Review Findings

### Strengths
- [What's done well]

### Areas for Improvement
| Area | Current State | Recommendation | Priority |
|------|---------------|----------------|----------|
| [Area] | [Issue] | [Fix] | HIGH/MED/LOW |

### Recommended Refactoring
1. [Specific action with rationale]
```

#### Code Quality Assessment

**Check for code smells:**
```bash
# Large files (potential god objects)
find . -type f \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.py" \) ! -path '*/node_modules/*' -exec wc -l {} \; | sort -rn | head -20

# Complex functions (many if/else, deep nesting)
grep -rn "if.*{" --include="*.ts" --include="*.tsx" | head -30

# TODO/FIXME comments
grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.ts" --include="*.tsx" --include="*.js" --include="*.py" | head -20
```

**Review testing:**
```bash
# Test file coverage
find . -type f \( -name "*.test.*" -o -name "*.spec.*" -o -name "*_test.py" \) ! -path '*/node_modules/*' | wc -l

# Source file count for comparison
find . -type f \( -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.py" \) ! -path '*/node_modules/*' ! -name "*.test.*" ! -name "*.spec.*" | wc -l
```

#### Security Audit

**Check for common vulnerabilities:**
```bash
# Hardcoded secrets
grep -rn "password\s*=\|api_key\s*=\|secret\s*=\|token\s*=" --include="*.ts" --include="*.js" --include="*.py" ! -path '*/node_modules/*' | head -20

# SQL injection risks
grep -rn "query.*\$\|execute.*\$\|raw.*\$" --include="*.ts" --include="*.js" --include="*.py" | head -20

# eval usage
grep -rn "\beval\b\|exec\b" --include="*.ts" --include="*.js" --include="*.py" | head -10
```

**Check dependencies:**
```bash
# Run security audit if available
npm audit 2>/dev/null | head -50
pip-audit 2>/dev/null | head -50
```

#### Performance Analysis

**Check for performance issues:**
```bash
# N+1 query patterns (multiple similar queries)
grep -rn "\.find\|\.findOne\|\.query\|\.select" --include="*.ts" --include="*.js" | head -30

# Missing indexes hints
grep -rn "ORDER BY\|GROUP BY\|WHERE" --include="*.sql" | head -20

# Large bundle concerns
cat package.json 2>/dev/null | jq '.dependencies' 2>/dev/null | head -30
```

### Step 4: Generate Report

**Create comprehensive CTO report:**

```markdown
# CTO Technical Assessment

**Project:** [Name]
**Date:** [Date]
**Reviewer:** AI CTO Advisor

---

## Executive Summary

[2-3 sentence overview of findings and key recommendations]

---

## Tech Stack Overview

| Layer | Technology | Version | Health |
|-------|------------|---------|--------|
| Frontend | [Tech] | [Ver] | Good/Fair/Poor |
| Backend | [Tech] | [Ver] | Good/Fair/Poor |
| Database | [Tech] | [Ver] | Good/Fair/Poor |
| Testing | [Tech] | [Ver] | Good/Fair/Poor |

---

## Architecture Assessment

### Current State
[Description of current architecture]

### Strengths
- [Strength 1]
- [Strength 2]

### Concerns
| Issue | Severity | Impact | Effort to Fix |
|-------|----------|--------|---------------|
| [Issue] | HIGH/MED/LOW | [Impact] | [Effort] |

---

## Code Quality

### Metrics
- Lines of Code: [X]
- Test Coverage: [X]%
- Technical Debt: [Low/Medium/High]

### Key Findings
1. [Finding with recommendation]
2. [Finding with recommendation]

---

## Security

### Vulnerabilities Found
| Issue | Severity | Location | Remediation |
|-------|----------|----------|-------------|
| [Issue] | CRITICAL/HIGH/MED/LOW | [File:Line] | [Fix] |

### Recommendations
1. [Security improvement]
2. [Security improvement]

---

## Performance

### Bottlenecks Identified
1. [Bottleneck with solution]
2. [Bottleneck with solution]

### Optimization Opportunities
1. [Opportunity]
2. [Opportunity]

---

## Prioritized Action Items

### Immediate (This Week)
1. [ ] [Critical issue to fix]

### Short-term (This Month)
1. [ ] [Important improvement]

### Long-term (This Quarter)
1. [ ] [Strategic initiative]

---

## Technical Debt Register

| Item | Origin | Impact | Estimated Effort | Priority |
|------|--------|--------|------------------|----------|
| [Debt item] | [When introduced] | [Impact] | [Hours/Days] | 1-5 |

---

## Appendix: Architecture Decision Records

### ADR-001: [Title]
**Status:** Proposed
**Context:** [Why is this decision needed?]
**Decision:** [What is the proposed solution?]
**Consequences:** [What are the trade-offs?]
```

### Step 5: Present and Discuss

**Present findings:**
```
## CTO Assessment Complete

I've analyzed your codebase. Here's a summary:

**Overall Health:** [Good/Fair/Needs Attention]

**Top 3 Priorities:**
1. [Priority 1] - [Severity]
2. [Priority 2] - [Severity]
3. [Priority 3] - [Severity]

**Quick Wins Available:** [Y/N - list if yes]

Would you like me to:
A. Show the full detailed report
B. Focus on security findings
C. Deep dive into architecture
D. Create a refactoring plan
E. Start implementing fixes
```

---

## Configuration File: cto-requirements.md

Create this file in your project to guide CTO reviews:

```markdown
# CTO Requirements

## Focus Areas
<!-- Which areas should receive priority attention? -->
- [ ] Architecture review
- [ ] Code quality
- [ ] Security audit
- [ ] Performance analysis
- [ ] Tech stack evaluation
- [ ] Testing strategy

## Constraints
<!-- What should the CTO consider when making recommendations? -->
- Budget: [Limited/Moderate/Flexible]
- Timeline: [Urgent/Normal/Long-term]
- Team size: [X developers]
- Team expertise: [Junior/Mixed/Senior]

## Known Issues
<!-- Document issues you're already aware of -->
1. [Known issue 1]
2. [Known issue 2]

## Out of Scope
<!-- What should NOT be reviewed this time? -->
- [Area to skip]

## Priority Questions
<!-- Specific questions to answer -->
1. [Question 1]
2. [Question 2]
```

---

## Tech Stack Evaluation Matrix

When evaluating technology choices:

| Criterion | Weight | Description |
|-----------|--------|-------------|
| **Fit** | 25% | Solves the specific problem well |
| **Maturity** | 20% | Production-ready, active community |
| **Team Fit** | 20% | Team can learn/use effectively |
| **Scalability** | 15% | Handles growth requirements |
| **Ecosystem** | 10% | Libraries, tools, integrations |
| **Cost** | 10% | Licensing, hosting, operations |

**Scoring Template:**

| Option | Fit | Maturity | Team | Scale | Ecosystem | Cost | **Score** |
|--------|-----|----------|------|-------|-----------|------|-----------|
| [Option A] | /10 | /10 | /10 | /10 | /10 | /10 | [Weighted] |

---

## Security Checklist

### Application Security
- [ ] Input validation on all user inputs
- [ ] Output encoding (XSS prevention)
- [ ] SQL injection prevention (parameterized queries)
- [ ] CSRF protection
- [ ] Rate limiting on APIs
- [ ] Secure session management

### Infrastructure Security
- [ ] HTTPS everywhere (TLS 1.3)
- [ ] Secrets in environment variables / secret manager
- [ ] Principle of least privilege (IAM)
- [ ] Regular dependency updates
- [ ] Security headers configured

### Data Security
- [ ] Encryption at rest
- [ ] Encryption in transit
- [ ] PII handling compliance
- [ ] Backup and disaster recovery
- [ ] Audit logging

---

## Scaling Tiers Guide

```
Tier 1: 0-1K users
├── Single server sufficient
├── Managed database (Supabase/Neon)
├── Basic caching
└── Estimated cost: $0-50/month

Tier 2: 1K-10K users
├── Horizontal scaling ready
├── Read replicas if needed
├── Redis caching layer
├── CDN for static assets
└── Estimated cost: $50-500/month

Tier 3: 10K-100K users
├── Auto-scaling groups
├── Database sharding consideration
├── Queue-based async processing
├── Full observability stack
└── Estimated cost: $500-5K/month

Tier 4: 100K+ users
├── Microservices consideration
├── Multi-region deployment
├── Advanced caching strategies
├── Dedicated database clusters
└── Estimated cost: $5K+/month
```

---

## Memory Integration

Save valuable insights to Memory MCP for cross-project learning:

**When to save:**
- Discovered an architectural pattern that worked well
- Found a security vulnerability pattern to avoid
- Learned something about a specific technology
- Made a strategic decision that proved successful

**Entity types:**
```javascript
// Save architectural pattern
mcp__memory__create_entities({
  entities: [{
    name: "architecture:pattern-name",
    entityType: "architecture-decision",
    observations: [
      "Context: when to use",
      "Pattern: what it is",
      "Benefits: why it works",
      "Trade-offs: what to watch for"
    ]
  }]
})

// Save security learning
mcp__memory__create_entities({
  entities: [{
    name: "security:vulnerability-type",
    entityType: "security-insight",
    observations: [
      "Vulnerability: description",
      "Detection: how to find it",
      "Prevention: how to avoid it",
      "Applies to: frameworks/languages"
    ]
  }]
})
```

---

## Quick Commands

| Command | Action |
|---------|--------|
| "status" | Show current review progress |
| "focus [area]" | Narrow review to specific area |
| "deep dive [component]" | Detailed analysis of component |
| "create adr" | Generate Architecture Decision Record |
| "fix [issue]" | Implement fix for identified issue |
| "plan refactor" | Create refactoring roadmap |

---

## Integration with Other Skills

### With autonomous-dev
When CTO review identifies refactoring needs:
```
CTO identifies issue → Creates refactoring PRD → autonomous-dev implements
```

### With fulltest-skill
CTO reads fulltest reports for context:
```
fulltest finds bugs → CTO analyzes patterns → Recommends systemic fixes
```

### With cpo-ai-skill
CTO serves as technical advisor during product development:
```
CPO defines product → CTO advises architecture → Implementation proceeds
```

---

## Example Invocations

### General Review
```
User: "Review this codebase as a CTO"

CTO Advisor:
1. Checks for cto-requirements.md (not found)
2. Checks for fulltest reports (not found)
3. Performs full codebase discovery
4. Analyzes architecture, code quality, security, performance
5. Generates comprehensive report
6. Presents summary with action items
```

### Focused Security Audit
```
User: "Do a security audit of the authentication system"

CTO Advisor:
1. Locates auth-related files
2. Reviews authentication flow
3. Checks for OWASP vulnerabilities
4. Reviews session management
5. Checks secrets handling
6. Generates security-focused report
```

### Architecture Decision
```
User: "Should we migrate from REST to GraphQL?"

CTO Advisor:
1. Analyzes current REST implementation
2. Evaluates GraphQL fit for use cases
3. Considers team expertise
4. Calculates migration effort
5. Provides scored recommendation
6. Creates ADR for decision
```

---

## Version

**Current Version:** 1.0.0
**Last Updated:** January 2026

---

## See Also

- [autonomous-dev](../autonomous-dev/SKILL.md) - For implementing refactoring recommendations
- [fulltest-skill](../fulltest-skill/SKILL.md) - For comprehensive testing
- [cpo-ai-skill](../cpo-ai-skill/SKILL.md) - For product lifecycle orchestration

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/escotilha) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-13 -->