/timebomb

Every codebase ticks. This one tells you when. Finds hardcoded expiry dates, expiry keywords, rotten "temporary" markers (with git age) and 32-bit time suspicion - prioritized by detonation date.

What this is for

• Hardcoded years, coupon deadlines, "// temporary, will be removed next week" from years ago - these bombs remain invisible because they are scattered and only explode on detonation day.
• Read-only skill. No automatic defusal, no certificate file parsing (only paths/mentions), no external expiry registries.

PROTECTION RULE - never ~/.claude/

Read-only skill. Guard required if write mode added later.

What You Must Do When Invoked

If /timebomb -help or /timebomb -h (without further arguments) is invoked: output the ## Usage section unchanged and stop.

Otherwise follow these steps in order, skipping none.

Step 1 - Help check

If invoked with -help or -h, output the ## Usage section unchanged and stop.

Step 2 - Clarify target

Clarify -ProjectDir. Record today's date (reference for "overdue"). Get confirmation.

Step 3 - Scan

& "<SKILL_DIR>/scripts/timebomb-scan.ps1" -ProjectDir "<path>"

Step 4 - Classification

Read each finding in context (if unclear, check the file location via Read):

• Live bomb: behavior changes on a concrete date. Name the detonation date; if in the past: overdue (highest priority - the bomb may have already exploded, describe possible symptom).
• Rotten provisional: rotten marker - what was the author's intent, what is the risk of the permanent state (blame date as evidence).
• False alarm: year in copyright, test data, token limits (e.g. maxOutputTokens: 2048), changelog - sort out, list in appendix. The collector deliberately reports broadly (even isolated years without comparison context); sorting them out is the core task here, not a side note.
• 32-bit findings: only report if the type actually stores time (suspected when uncertain).

Step 5 - Write report

File timebomb-report.md in the current working directory:

1. Summary - count: overdue / ticking / rotten.
2. Defusal list - sorted: overdue first, then by detonation date ascending, then provisionals by age descending. Per finding: class, detonation date or age, evidence (file:line, blame date), concrete defusal suggestion.
3. False alarms in appendix.
4. Open questions.

Evidence requirement: detonation date only from the literal, age only from blame; no estimated date without suspected label.

Step 6 - Summarize

State the report path, summarize overdue findings first.

Usage

/timebomb               # interactive
/timebomb <dir>         # scan project
/timebomb -help