---
name: 07-refactor
description: Improve code across four axes (cleanup, performance, security, architecture) by scanning and fixing, or applying a pushed audit report. Use when the user wants to refactor, optimize, harden, or remove code. Not for read-only diagnosis or adding tests.
argument-hint: scope | audit
---

# Skill: refactor

The act-side of code improvement: it changes code to make it better. Behavior-preserving for cleanup, performance, and architecture; security may change behavior on purpose to close a hole.

## Actions

| #   | Action         | Axis         | Lens                                                       |
| --- | -------------- | ------------ | ---------------------------------------------------------- |
| 01  | `performance`  | performance  | N+1, hot paths, batching, memoization, unnecessary I/O      |
| 02  | `security`     | security     | OWASP, input validation, authz, secrets: harden and fix    |
| 03  | `cleanup`      | code-quality | clean code: rename, extract, DRY, dead code, complexity     |
| 04  | `architecture` | architecture | extract layers, fix coupling, enforce boundaries            |

Run the one axis named, or offer all applicable when the request is unscoped.
Before running an action, read its file in `actions/`, not only the table or assets.

## Transversal rules

- Scope: run the one named axis, or for an unscoped request ask once "all applicable axes, or one?" before running. A request to delete or remove code runs `cleanup` directly, with no axis question. Never silently default to one axis.
- Behavior-preserving for cleanup, performance, and architecture: public inputs and outputs stay identical, verified by tests, type checks, or a side-by-side run. Security may alter behavior to close a vulnerability, and must call that out explicitly.
- Audit-fed, optional: when the caller pushes an audit report (a path under `aidd_docs/tasks/audits/` or pasted findings), take its findings for this axis as the fix list and skip the scan. The bridge is the report artifact; this skill never loads or calls another skill. The audit `code-quality` pillar feeds the `cleanup` axis; the other axes map by name.
- Severity uses the shared 3-level scale: 🔴 critical, 🟡 warning, 🟢 minor.
- Stay inside the axis: dependency upgrades and UI redesign are out of scope. Add tests only as a regression for a security fix, never otherwise.