Tech Stack Due Diligence Skill

A reusable, evidence-based technical due diligence system. It behaves like a senior CTO, security architect, and software diligence consultant working from a standardized playbook.

What this is

This project provides:

• A skill (skills/tech-stack-due-diligence/SKILL.md) that encodes methodology, evidence taxonomy, scoring, and deliverables — used by Claude Code, packaged as a plugin via .claude-plugin/plugin.json.
• An agent definition (AGENTS.md for Codex, agents/agent.yaml as the underlying structured reference) that drives a structured investigation.
• A set of deterministic analysis scripts (scripts/) that produce reproducible evidence signals.
• Templates (assets/) for reports, risk registers, evidence inventories, findings, and remediation plans.
• Reference rubrics (references/) for architecture, security, infrastructure, AI/ML, evidence, scoring, and transaction risk.

When to use it

Use this system for:

• Investment diligence
• Acquisition diligence
• Enterprise procurement / vendor diligence
• Partnership or joint-venture technical review
• Internal audit or readiness review before a fundraise, exit, or major launch

It accepts any combination of repositories, architecture diagrams, infrastructure exports, dependency manifests, CI/CD configuration, security policies, database schemas, API documentation, roadmaps, cost reports, incident history, organization charts, questionnaires, and stakeholder responses.

Quick start

Run the full deterministic analysis

python3 scripts/run_due_diligence.py <path-to-repo> --output evidence-manifest.json

This runs the appropriate subset of scripts for the repository and writes a consolidated evidence manifest. Review the manifest and incorporate its outputs into the evidence inventory with the correct evidence classification and confidence.

Run individual scripts

python3 scripts/analyze_repository.py <repo-path>
python3 scripts/inventory_dependencies.py <repo-path> --csv dependencies.csv
python3 scripts/calculate_bus_factor.py <repo-path>
python3 scripts/inspect_licenses.py <repo-path>
python3 scripts/check_secrets.py <repo-path>
python3 scripts/inspect_containers.py <repo-path>
python3 scripts/check_iac_coverage.py <repo-path>
python3 scripts/map_api_surface.py <repo-path>
python3 scripts/check_migration_consistency.py <repo-path>
python3 scripts/analyze_test_coverage.py <repo-path>
python3 scripts/inventory_model_artifacts.py <repo-path>
python3 scripts/compile_findings.py findings-*.json --markdown compiled-findings.md

All scripts use only the Python standard library unless an existing dependency is already present in the target project. They do not contact external APIs or vulnerability databases by default.

How to invoke the skill

In Claude Code

This repo is packaged as a Claude Code plugin (.claude-plugin/plugin.json) containing one skill, skills/tech-stack-due-diligence/SKILL.md. Install it as a plugin, or use it as a standalone skill.

As a plugin (from a local checkout):

/plugin marketplace add /path/to/tech-stack-due-diligence
/plugin install tech-stack-due-diligence@tech-stack-due-diligence

As a standalone skill, symlink just the skill directory (its SKILL.md resolves references/, assets/, and scripts/ two levels up, so keep the whole repo checked out):

ln -s ~/dev/tech-stack-due-diligence/skills/tech-stack-due-diligence ~/.claude/skills/tech-stack-due-diligence

Either way, ask for a technical due diligence review and Claude Code will follow the workflow in SKILL.md, using references/ for rubrics and assets/ for templates.

Example:

Review the repository at ~/acme-corp/platform/ for a Series A investment diligence.

The agent will:

1. Confirm context and priorities.
2. Run the deterministic scripts.
3. Build an evidence inventory.
4. Review architecture, security, infrastructure, data, dependencies, team, and roadmap.
5. Produce findings with calibrated evidence classifications.
6. Deliver the executive memo, detailed report, risk register, stack manifest, and 100-day plan.

Before publishing to a marketplace, validate the plugin locally:

claude plugin validate
claude --plugin-dir .

In Codex

When this repository is open, Codex reads AGENTS.md as the project's agent instructions. Ask for a technical due diligence review and it will follow the seven-step workflow, running the scripts in scripts/ and using references/ and assets/ as documented.

Example:

Review the repository at ~/acme-corp/platform/ for a Series A investment diligence.

agents/agent.yaml remains the canonical, structured reference for the persona, workflow, and quality gates behind AGENTS.md — consult it if you need the definition in a stricter format than prose.

Evidence taxonomy

Every material claim must be classified as one of:

• Verified — directly supported by code, configuration, logs, or documentation
• Corroborated — supported by multiple independent indirect sources
• Management-reported — stated but not independently confirmed
• Inferred — analytically derived from available evidence
• Unknown — insufficient evidence
• Contradicted — evidence conflicts with the stated claim

Confidence (strong, moderate, weak) is separate from severity.

Scoring model

Do not use a single composite score by default. Score separately:

• Maturity (1 ad hoc → 5 optimized)
• Risk (informational, low, moderate, high, critical)
• Evidence confidence (weak, moderate, strong)
• Transaction impact (informational, remediation, valuation-adjustment, condition-to-close, deal-threatening)
• Remediation horizon (0-30 days, 31-90 days, 91-180 days, 180+ days)

See references/scoring-rubric.md for full definitions and stage-adjusted targets.

Deliverables

Deliverable	Template
Executive diligence memo	assets/executive-report-template.md
Detailed technical report	assets/detailed-report-template.md
Risk register	assets/risk-register-template.csv
Technical stack manifest	assets/stack-manifest-template.json
100-day remediation plan	assets/100-day-remediation-plan.md

Project structure

.
├── .claude-plugin/plugin.json       # Claude Code plugin manifest
├── skills/tech-stack-due-diligence/
│   └── SKILL.md                     # Skill definition and methodology
├── AGENTS.md                        # Agent instructions (Codex)
├── agents/agent.yaml                # Model-agnostic agent definition
├── README.md                        # This file
├── LICENSE                          # MIT license
├── references/                      # Review rubrics and standards
│   ├── architecture-review.md
│   ├── security-review.md
│   ├── infrastructure-review.md
│   ├── ai-ml-review.md
│   ├── evidence-standard.md
│   ├── scoring-rubric.md
│   └── transaction-risk.md
├── assets/                          # Templates and questionnaires
│   ├── executive-report-template.md
│   ├── detailed-report-template.md
│   ├── risk-register-template.csv
│   ├── evidence-inventory-template.csv
│   ├── finding-template.json
│   ├── stack-manifest-template.json
│   ├── 100-day-remediation-plan.md
│   └── diligence-questionnaire.md
└── scripts/                         # Deterministic analysis scripts
    ├── run_due_diligence.py
    ├── analyze_repository.py
    ├── inventory_dependencies.py
    ├── calculate_bus_factor.py
    ├── inspect_licenses.py
    ├── check_secrets.py
    ├── inspect_containers.py
    ├── check_iac_coverage.py
    ├── map_api_surface.py
    ├── check_migration_consistency.py
    ├── analyze_test_coverage.py
    ├── inventory_model_artifacts.py
    └── compile_findings.py

Core workflow

1. Define the diligence context — transaction type, stage, scale, regulatory exposure, priorities, timeline, access constraints.
2. Build an evidence inventory — classify every material claim using references/evidence-standard.md.
3. Map the stack — produce a human-readable inventory and a stack-manifest.json.
4. Analyze major domains — architecture, code quality, infrastructure, security, data, AI/ML, reliability, dependencies, team, roadmap.
5. Run deterministic analysis — use the scripts to generate reproducible evidence signals.
6. Validate script output — cross-check every script-derived number against an independent method before it becomes evidence. These are heuristics; each has a failure mode that produces a confident wrong number.
7. Verify findings adversarially — for every high/critical finding, state what would make it false and go look. A plausible, internally consistent, wrong finding is this work's characteristic failure.
8. Identify risks and remediation — record structured findings with severity, likelihood, confidence, effort, horizon, owner, and transaction impact.
9. Produce transaction conclusions — answer whether the platform supports the business plan, what was verified, and what must be resolved before closing.

Important limitations

The scripts are heuristics and several have known failure modes that produce confident wrong numbers. Step 6 of the workflow exists specifically to catch them. Do not paste raw script output into a report.

• The scripts are signal generators, not proof of control effectiveness. Interpret them with appropriate confidence.
• This system does not perform penetration tests, legal reviews, compliance certifications, or investment advice unless explicitly scoped.
• Do not issue legal, regulatory, accounting, or investment conclusions beyond the available evidence.
• Stage calibration matters: a pre-seed startup is not evaluated against the same standard as a mature healthcare platform.

Contributing

To add a new domain checklist or reference rubric, place it in references/ and update skills/tech-stack-due-diligence/SKILL.md to link it. To add a new deterministic script, place it in scripts/ and update scripts/run_due_diligence.py and agents/agent.yaml if it should be part of the default orchestration.

License

MIT — see LICENSE.