forge-healthlisted

# forge-health The periodic QA pass for aggregate quality. Every unit passes `forge-verify` on its own, but nobody owns the aggregate properties — coverage gaps between units, error handling that thins out across boundaries, a dependency audit nobody ran. This skill owns them. It detects and prioritizes; fixing always flows through the normal pipeline. ## Argument Text after the command scopes the check (e.g. `/forge-health just security and tests` or `/forge-health src/api`). No argument → all five dimensions, whole codebase. ## The five dimensions 1. **Test-suite health** — coverage gaps on critical paths (run the project's coverage tool if configured), hollow tests (assert nothing meaningful), skipped or permanently-failing tests, suites that don't run in CI. 2. **Error handling** — critical paths (auth, payments, data writes, external calls) with missing/swallowed errors; user-facing failure states that were never designed. Judged against the spec'd error handling in `code-standards.md` — this is about *missing* handling on real paths, never speculative handling (simplicity first still applies). 3. **Security hygiene (basic)** — secrets committed in code/config, obvious injection-prone string building, missing auth checks on mutating routes, and the dependency audit (`npm audit` / `pip-audit` / `cargo audit` — whatever the stack provides). This is hygiene, not a pentest — say so in the report. 4. **Performance smells** — N+1 query patterns,