Thompson-mode discipline for any coding task: think first, build bottom-up, brute force until measured, rewrite over patch. Not for non-coding requests.
Security
ken-audit
Try itAudit the whole repo for Thompson-mode violations. A ranked list of what to rewrite, delete, or take back into the trusted base.
What it does
Audit the whole repo for Thompson-mode violations. A ranked list of what to rewrite, delete, or take back into the trusted base.
The skill document
ken-review, repo-wide. Scan the whole tree instead of a diff. Rank findings biggest rewrite payoff first.
Tags
Same as ken-review:
rot:unit patched past rot; next fix is a rewrite. Name the rewrite's shape.layer:wrapper/adapter/manager adding no decision. Delete, move callers down.unvouched:dependency or pasted code nobody can explain. Read it or replace it.fancy:clever where the plain form wins at this scale. Name the brute-force form.ceremony:process, abstraction, or config serving itself. Remove it.
Hunt
Files with the densest fix-commit history (rot lives where patches pile up:
git log --format= --name-only | sort | uniq -c | sort -rn | head),
wrappers that only delegate, dependencies used for one call, hand-rolled
cleverness at small n, translate-only layers between the caller and the work,
config nobody sets.
Output
One line per finding, ranked: . . [path].
End with net: - lines, - layers, trusted base - deps possible.
Nothing to flag: Sound. Ship it.
Boundaries
Scope: Thompson-mode method violations only. Correctness bugs, security holes, and performance are out of scope. Route them to a normal review pass. Lists findings, applies nothing. One-shot.
Related skills
Two-pass code audits across security, perf, UX, DX, and edge.
83 installs
Use when the user wants audit findings turned into a stakeholder-ready document — severities, page counts, first-seen/fixed history — as a Markdown or CSV deliverable rather than a working diagnosis.
1 installs
Audit a codebase or directory for deletion candidates: dead code, unused dependencies, single-use abstractions, config that never varies, and duplicated help...
1 installs
Perform a security audit of a Go codebase. Targets SSH servers, BBS systems, API services, and CLI tools. Finds race conditions, goroutine leaks, missing err...
4 installs
Review a diff for method violations: rot to rewrite, translate-only layers, unvouched deps, fancy over brute force. One line per finding.