Agent skill · research science · onewave-ai
tech-due-diligence
Technical due diligence for M&A, investment, or acquisition. Reads a target company's codebase and generates a comprehensive tech DD report with architecture assessment, tech debt quantification, scalability analysis, security posture, team capability inference, build system quality, test coverage, deployment maturity, and open source license risks. Outputs tech-dd-report.md formatted like a real investment memo with risk ratings, remediation costs, and go/no-go recommendation.
Why this skill is useful
Generates a comprehensive tech due diligence report with specific metrics and risk assessments that the AI cannot produce without this structured approach.
What it needs
Requires bash installed locally. About 2k tokens when loaded. Last updated 2026-07-15. 242 stars on the source repository.
What this skill does
Technical Due Diligence Agent Read a target company's codebase and produce a technical due diligence report that a non-technical investment committee member can act on, with the depth a CTO or VP Engineering expects. Contents references/investigation-protocol.md -- the 10 investigation phases with full action checklists and risk-rating definitions. references/output-template.md -- the exact tech-dd-report.md report structure, all tables, and the glossary. Workflow 1. Resolve the target. Accept a local codebase path, or clone a GitHub URL first. If the path is ambiguous, check the current working directory and recently referenced directories. Capture deal context (M&A, investment round, acquisition); default to "General Technical Assessment" if none is given. Begin immediately -- do not ask for confirmation. 2. Run the full investigation. Execute all 10 phases in order per references/investigation-protocol.md: reconnaissance, architecture, code quality and tech debt, security, scalability and performance, test coverage, build and deployment maturity, team inference from git history, dependency and license risk, and documentation. Read representative samples, not every file. Concentrate effort where risk signals appear. 3. Generate the report. Write tech-dd-report.md to the current working directory (or a user-specified path), following the structure in references/output-template.md exactly. Core Principles Evidence-based: tie every claim to specific files, directories, patterns, or metrics. Label any speculation as such. Quantified: attach numbers wherever possible -- lines of code, file counts, dependency counts, commit recency, test-to-code ratios, complexity estimates, vulnerability counts. Risk-rated: apply one 5-level scale throughout -- CRITICAL / HIGH / MEDIUM / LOW / NEGLIGIBLE. Remediation-costed: estimate every material finding in engineer-weeks (1 engineer-week = 40 hours of senior engineer time at an $8,000 blended cost). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills onewave-ai/tech-due-diligence