/leak-scan

Production incidents caused by leaked resources: this skill finds them before deployment.

What this is for

• DB connection pools exhausted, file handles left open
• HTTP connections not closed, temp files never cleaned up
• Event listeners not unregistered
• Read-only skill. No code modification, no automated fix.

PROTECTION RULE - never ~/.claude/

Read-only skill. Guard required if write mode added later.

What You Must Do When Invoked

During analysis, assign a confidence level to each finding: proven (confirmed by evidence), likely (strong signal, needs review), or suspected (weak signal).

If /leak-scan -help or /leak-scan -h (without further arguments) is invoked: output the ## Usage section unchanged and stop.

Otherwise follow these steps in order, skipping none.

Step 1 - Help check

If invoked with -help or -h, output the ## Usage section unchanged and stop.

Step 2 - Clarify target

Clarify -ProjectDir. Get confirmation.

Step 3 - Scan

& "<SKILL_DIR>/scripts/resource-trace.ps1" -ProjectDir "<path>"

Step 4 - Classification

Read each resource in context:

• Safe: acquired and released in all paths (finally block, using, defer, RAII)
• Potential leak: acquired but release is conditional or missing in error paths
• Confirmed leak: acquired with no release path in any code branch
• Intentional escape: resource returned, stored, or passed to callback (factory, pool)

Step 5 - Write report

File leak-report.md in current working directory:

1. Summary - total resources, clean, potential-leak, confirmed-leak.
2. Leak table - confirmed first. Per resource: file, line, type, classification, evidence, fix suggestion.
3. Intentional escapes in appendix.
4. Open questions.

Step 6 - Summarize

State report path, highlight confirmed leaks.

Usage

/leak-scan               # interactive
/leak-scan <dir>         # scan project
/leak-scan -help