Two paired Claude Code skills for looking after machines:
| Skill | Job | Doctrine |
|---|---|---|
spring-clean |
Find and remove the residue of decommissioned software — files, caches, units, crons, secrets, and access left behind. | Subtractive. Worst case is deleting a live thing → "when unsure, keep it." |
doctor |
Find what's quietly broken — security controls that fail silently, rotting fuses, exposure — and fix only what's provably safe. | Corrective. Worst case is breaking a running box → "when unsure, change nothing." |
spring-clean hands off to doctor at the end, so one invocation covers both.
Uninstalling software is easy. Removing its residue is where it goes wrong, because residue is invisible by definition — it's the stuff nobody remembers installing. And the residue that matters most isn't disk space:
- Live API keys in shell rc files, systemd drop-ins, and shell history long after the tool is gone.
- Access paths — a service account with a shell, an
authorized_keysentry for a departed CI runner, asudoers.ddrop-in, an ALLOW rule for a port nothing listens on. - Secrets inside AI agent transcripts. An agent that audits a config echoes the key verbatim into its own log. Scrub the system, declare it clean, and the key is still on the box. This one is real — it's why the skill exists in this form.
And the health half exists because of a matching failure: a file-integrity monitor, installed after a real breach, that had never worked once in 69 nights. It was silent by configuration. The box looked healthy because nothing was watching the watcher.
claude plugin marketplace add stevenjtobin/spring-clean
claude plugin install spring-clean@prasutagus-toolsThen invoke with /spring-clean:spring-clean or /spring-clean:doctor, or just describe the job
("clean up this server", "is anything broken?") and Claude will route to it.
Plugin skills are namespaced. If you'd rather type /spring-clean and /doctor:
git clone https://github.com/stevenjtobin/spring-clean.git ~/projects/spring-clean
ln -s ~/projects/spring-clean/plugins/spring-clean/skills/spring-clean ~/.claude/skills/spring-clean
ln -s ~/projects/spring-clean/plugins/spring-clean/skills/doctor ~/.claude/skills/doctorUpdate with git -C ~/projects/spring-clean pull.
Plugin installs: claude plugin marketplace update prasutagus-tools && claude plugin update spring-clean.
Auto-update is disabled by default for third-party marketplaces — enable it per-machine in
/plugin → Marketplaces → Enable auto-update, or run the two commands above from cron.
Neither skill deletes without confirmation, acts on an unproven candidate, or touches what it can't
classify. doctor additionally never reboots or restarts a production box, and never runs
systemctl reset-failed — clearing a unit from the failed list without fixing it makes the box
look healthy, and a skill that launders its own findings is worse than no skill.
Only 3 of doctor's 16 checks are auto-fixable. That's the design, not a shortfall.
MIT — see LICENSE.