code-quality

Nitpicky Narwhal

Most creatures with a three-metre spike protruding from their face would use it for something dramatic. Jousting, perhaps, or opening letters in a threatening manner. The narwhal instead uses it to poke at things in cold, dark water where nobody is watching, which is more or less what this skill does to your code at two in the morning. It will find the unused variable you left in a file you forgot existed. It will notice that module A imports module B which imports module C which imports module A. It will not be thanked for this, and it does not expect to be.

A code quality skill for AI agents. Linting, type checking, complexity analysis, security scanning, comprehensive review, and architecture review using whatever tools your project already has.

What It Does

The skill finds your project's linter, runs it, normalizes the output, and hands you back findings you can act on. No server setup. No MCP configuration. No tokens wasted when not in use. It also runs deeper analysis: architecture review, dual-metric complexity, security scanning, and type checking — all zero-install where possible via npx or uvx.

No config? No problem. The skill ships with built-in defaults (inspired by SonarQube's "Sonar way" quality profile) so analysis works even on projects with zero linter setup. When your project has its own config, the skill uses that instead.

Supported languages and tools:

• JavaScript/TypeScript: ESLint, Biome, madge (cycles), knip (dead code), tsc (types), eslint-plugin-sonarjs (cognitive complexity)
• Python: ruff, depcycle (cycles), vulture (dead code), pyright (types), flake8-cognitive-complexity
• Security (all languages): Semgrep (SAST, 2000+ OWASP/CWE rules), detect-secrets (hardcoded credentials)

Install

npx skills add CyranoB/code-quality-skill

Auto-detects your coding agent, installs into the current project by default, and supports Claude Code, Cursor, Codex, Cline, Gemini CLI, Windsurf, and 50+ others.

Global install (available in every project):

npx skills add CyranoB/code-quality-skill -g

/plugin marketplace add CyranoB/code-quality-skill
/plugin install code-quality@code-quality-marketplace

git clone https://github.com/CyranoB/code-quality-skill.git
mkdir -p .agents/skills
cp -R code-quality-skill/skills/code-quality .agents/skills/

git clone https://github.com/CyranoB/code-quality-skill.git
aider --read code-quality-skill/skills/code-quality/SKILL.md

The skill needs bash, python3, npx, and uvx on PATH. Local agents almost always have these. If your agent runs in a sandbox, check that the sandbox includes them.

Workflows

Lint

Triggers: "review src/index.ts", "what's wrong with this file?", "lint main.py", "fix linting errors", "audit my project", "scan the whole project"

Runs the project's linter on a file, directory, or whole project. In analyze mode it reports lint plus explicit cyclomatic and cognitive complexity findings so complexity does not depend on the project's own linter config. In fix mode it captures a baseline, applies the native --fix / --write command, re-runs analysis, and reports what changed and what remains.

Project audits cap output at 50 findings sorted by severity, show the most problematic files, count auto-fixable issues, and call out manual-only complexity refactors.

Pre-commit Check

Triggers: "check before commit", "pre-commit check", "ready to commit?", "lint my changes"

Detects changed files via git, lints only those files, and also runs the type checker (pyright for Python, tsc for TypeScript) if one is configured. Returns a clear PASS or FAIL verdict. Designed to be fast enough to run every commit, so it skips cognitive complexity unless explicitly requested.

Type Check

Triggers: "type check", "verify types", "run pyright", "run tsc", "check types", "type errors"

Runs npx pyright for Python or npx tsc --noEmit for TypeScript and normalizes the output. Pyright errors map to CRITICAL; warnings to MAJOR. Filters reportMissingTypeStubs noise into a single summary line.

Architecture Review