# Quality Baseline

> Baseline a repository before quality work. Use when asked to audit maintainability, reliability, performance, security, test quality, technical debt, or code health across a codebase; to identify and rank gaps before fixing them; or to compare quality state over time. Remain read-only on target source.

- **Type:** Skill
- **Install:** `agentstack add skill-railly-skills-quality-baseline`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Railly](https://agentstack.voostack.com/s/railly)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Railly](https://github.com/Railly)
- **Source:** https://github.com/Railly/skills/tree/main/skills/.experimental/quality-baseline

## Install

```sh
agentstack add skill-railly-skills-quality-baseline
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Quality baseline

Build an evidence ledger, not a generic score. A missing checked-in control is a gap in visible repository evidence, not proof that no organization-level control exists.

## 1. Freeze repository identity

Record repository path, remote identity, HEAD, branch, working-tree state, stack, package manager, instruction files, CI workflows, and exact verification commands. Preserve unrelated changes.

**Complete when:** another reader can reproduce the inspected state and commands.

## 2. Map critical paths and controls

Trace the user-visible and operational paths whose failure would matter. For each path, map:

- functional contracts and external specifications;
- test layers and whether they exercise the real boundary;
- latency, throughput, memory, or size observability;
- timeout, retry, cancellation, cleanup, recovery, and overload behavior;
- dependency, secret, trust-boundary, and release controls;
- supported runtimes, operating systems, renderers, or protocol surfaces.

Use history, churn, and change coupling only as prioritization evidence. A large or frequently edited file is not a defect by itself.

**Complete when:** every critical path has an evidence-backed control map or an explicit verification gap.

## 3. Prove or reject findings

For every candidate gap, capture:

- exact evidence and affected contract;
- plausible failure and impact;
- confidence and important unknowns;
- smallest useful verification;
- fix effort and regression risk.

Reject code-smell findings that do not connect to a failure, change-safety cost, measurable bottleneck, or violated repository rule. Reject optimization claims without a workload and measurable symptom. Reject "add tests" without naming what the test must detect.

**Complete when:** every retained finding has a verification story and every investigated rejection has a reason.

## 4. Rank pilot work

Rank by impact, evidence strength, verification cost, fix risk, and reversibility. Prefer one bounded pilot whose result can be measured. Route:

- measured bottlenecks to `performance-proof`;
- weak regression protection to `test-strength`;
- failure-path exposure to `resilience-audit`;
- a selected defect to the repository's triage workflow.

**Complete when:** the top recommendation names the contract, evidence, first experiment, stop condition, and expected proof.

## 5. Deliver the baseline

Return a quality matrix, critical-path map, ranked findings, rejected findings, verification gaps, and next pilot. Include a machine-readable representation when the user requests a persistent or repeatable baseline. Do not change target source under this skill.

**Complete when:** the report distinguishes evidence, inference, and unknowns, and contains no synthetic global quality score.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Railly](https://github.com/Railly)
- **Source:** [Railly/skills](https://github.com/Railly/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-railly-skills-quality-baseline
- Seller: https://agentstack.voostack.com/s/railly
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.