From thoughtbot-dev
Perform comprehensive code audits of Ruby on Rails applications based on thoughtbot best practices. Use this skill when the user requests a code audit, code review, quality assessment, or analysis of a Rails application. The skill analyzes the entire codebase focusing on testing practices (RSpec), security vulnerabilities, code design (skinny controllers, domain models, PORO with ActiveModel), Rails conventions, database optimization, and Ruby best practices. Outputs a detailed markdown audit report grouped by category (Testing, Security, Models, Controllers, Code Design, Views) with severity levels (Critical, High, Medium, Low) within each category.
How this skill is triggered — by the user, by Claude, or both
Slash command
/thoughtbot-dev:code-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Perform comprehensive Ruby on Rails application audits based on thoughtbot's Ruby Science and Testing Rails best practices, with emphasis on Plain Old Ruby Objects (POROs) over Service Objects.
Perform comprehensive Ruby on Rails application audits based on thoughtbot's Ruby Science and Testing Rails best practices, with emphasis on Plain Old Ruby Objects (POROs) over Service Objects.
The audit can be run in two modes:
Ask user or infer from request:
app/, spec/ or test/, config/, db/, lib/Ask the user both questions upfront in a single AskUserQuestion so they can decide once:
Based on the user's choice, spawn the accepted subagents in parallel using the Task tool. Both can run at the same time because SimpleCov modifies the test helper while RubyCritic only reads source files — they don't conflict.
SimpleCov subagent (if accepted):
Read the file
agents/simplecov_agent.mdand follow all steps described in it. The audit scope is: {{SCOPE from Step 1}}. Return the coverage data in the output format specified in that file.
RubyCritic subagent (if accepted):
Read the file
agents/rubycritic_agent.mdand follow all steps described in it. The audit scope is: {{SCOPE from Step 1}}. Return the code quality data in the output format specified in that file.
After both agents finish, clean up:
rm -rf coverage/rm -rf tmp/rubycritic/Interpreting responses:
COVERAGE_FAILED / RUBYCRITIC_FAILED: no data for that tool — use estimation mode (SimpleCov) or omit the section (RubyCritic). Note the failure reason in the report.COVERAGE_DATA: parse and keep in context for Steps 4 and 5 (overall coverage, per-directory breakdowns, lowest-coverage files, zero-coverage files).RUBYCRITIC_DATA: parse and keep in context for Steps 4 and 5 (overall score, per-directory ratings, worst-rated files, top smells, most complex files).Before analyzing, read the relevant reference files:
references/code_smells.md - Code smell patterns to identifyreferences/testing_guidelines.md - Testing best practicesreferences/poro_patterns.md - PORO and ActiveModel patternsreferences/security_checklist.md - Security vulnerability patternsreferences/rails_antipatterns.md - Rails-specific antipatterns (external services, migrations, performance)Analyze in this order:
Testing Coverage & Quality
Security Vulnerabilities
Models & Database
Controllers
Code Design & Architecture
Views & Presenters
External Services & Error Handling
Database & Migrations
Create RAILS_AUDIT_REPORT.md in project root with structure defined in references/report_template.md.
When SimpleCov coverage data was collected in Step 2, use the SimpleCov variant of the Testing section in the report template. When coverage data is not available, use the estimation variant.
When RubyCritic data was collected in Step 2b, include the Code Quality Metrics section in the report using the RubyCritic variant from the report template. When RubyCritic data is not available, use the not available variant.
When you find classes in app/services/:
*Service, *Manager, *Handler.call or .perform methodsActiveModel::ModelModels with:
Controllers with:
For each Ruby file in app/:
_spec.rb or _test.rbUse Claude Code's built-in tools instead of shell commands — they're faster, handle permissions correctly, and give better output:
app/models/**/*.rb, app/controllers/**/*.rb, app/services/**/*.rbspec/**/*_spec.rb or test/**/*_test.rbrescue\s*$, \.save\b, params\.permit!)app/**/*.rb files, then Read each to check line countAlways save the audit report to RAILS_AUDIT_REPORT.md in the project root and present it to the user.
Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
npx claudepluginhub thoughtbot/thoughtbot-dev --plugin thoughtbot-dev