Stats
Actions
Tags
From Code Quality Atlas
Audits compliance, licensing, and provenance: dependency licenses, copyleft contamination, SPDX headers, PII data flows, consent gating, and SBOM currency. Escalates to humans.
How this skill is triggered — by the user, by Claude, or both
Slash command
/code-quality-atlas:auditing-compliance-and-provenanceThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
*Any licensing, PII, or provenance exposure? Detect and escalate to humans — never decide legal questions.*
Any licensing, PII, or provenance exposure? Detect and escalate to humans — never decide legal questions.
Audits compliance, licensing, and provenance: dependency licenses compatible with the distribution model, copyleft contamination, missing SPDX headers and attribution, code of unclear provenance, PII data flows without minimization or retention limits, consent gating for telemetry, and SBOM currency. Detects and escalates to humans rather than deciding legal questions. A repo-wide / scheduled audit. Use when auditing licenses, PII handling, data retention, or provenance.
Shape: repo. Run against the whole repository (scheduled or on demand), not a single diff.
Report only real problems. If the code correctly handles the case, reply "No findings" and stop — do not invent issues. This guards against false positives on correct code; still report every genuine issue you do find, with its full detail.
Defects are the default; improvements are opt-in. By default this lens is defect-only: do not suggest changes to code that is already correct. When the team has opted up into improvement suggestions, a finding on already-correct code is admissible only as nit-severity, route: implementer (the author applies, defers, or ignores), and must clear the non-configurable anti-churn floor: it must genuinely improve — never offer a merely equivalent alternative — and must converge (once a dimension is as good as you can confidently make it, stop; never oscillate A→B then B→A, never re-order to an equivalent state). Defects keep the strict bar above regardless of this setting.
The head of the full checklist — enough for a first pass without opening any reference file:
SPDX-License-Identifier + copyright (REUSE)? Missing header = provenance gap.Where a finding here is one a tool can catch deterministically, surface that as an advisory route: implementer note next to the finding: the hand review caught it this time, and wiring the matching tool from reference/tool-rules.md into CI gates it going forward. This is a suggestion to mechanize, not a defect — it never blocks a verdict, and it falls away on a repo that already runs the tool.
npx claudepluginhub brandondees/code-quality-atlas --plugin code-quality-atlasProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.