Skills investigating-codebases
📦
investigating-codebases
v1.0.0 Content revision r2 High Risk 📁 Filesystem access⚙️ External commands
Investigate Unfamiliar Codebases
Unfamiliar repositories make implementation questions slow and uncertain. This skill maps structure, traces dependencies, and explains behavior with concrete file references.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "investigating-codebases" from https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases.md and its manifest at https://skillstore.io/api/skills/c0ntr0lledcha0s-investigating-codebases/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "investigating-codebases". Where is user authentication implemented?
Expected outcome:
- The investigation identifies the request middleware, token validator, session storage, and login handler.
- It explains the decision branches and cites each relevant file and line.
Using "investigating-codebases". Explain how the application starts.
Expected outcome:
The report traces startup from the main entry point through configuration, dependency initialization, route registration, and server startup.
Using "investigating-codebases". Map the payment workflow and its failure paths.
Expected outcome:
- The analysis follows request validation, payment service calls, persistence, retries, and error responses.
- It separates verified behavior from open questions and lists related components.
Security Audit
High Riskv9 • 7/23/2026 Open versioned report
Most alerts are false positives caused by Markdown backticks, documentation examples, file discovery, quoted metadata commands, and `/dev/null` redirection. Five `find` substitutions are confirmed because an option-like project argument can be interpreted as `-delete` and remove files. The same flaw affects four earlier `find` pipelines; no prompt injection, network activity, credential access, or exfiltration was found.
9
Files scanned
1,543
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (1)
High
scripts/map-structure.sh:20scripts/map-structure.sh:29-37scripts/map-structure.sh:41-48scripts/map-structure.sh:52-58
Project Directory Option Injection
Four direct `find` pipelines accept an option-like project argument. A value such as `-delete` can remove files from the working directory.
Each pipeline places the unnormalized positional argument where `find` accepts expressions. The documented `-delete` action provides a direct destructive path.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
echo "TypeScript: $(find "$PROJECT_DIR" -type f -name "*.ts" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
High
Shell command substitution
echo "JavaScript: $(find "$PROJECT_DIR" -type f -name "*.js" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
High
Shell command substitution
echo "Python: $(find "$PROJECT_DIR" -type f -name "*.py" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
High
Shell command substitution
echo "Go: $(find "$PROJECT_DIR" -type f -name "*.go" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
High
Shell command substitution
echo "Rust: $(find "$PROJECT_DIR" -type f -name "*.rs" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
Risk Factors
📁 Filesystem access (12)
references/framework-clues.md:8 scripts/map-structure.sh:15 scripts/map-structure.sh:17 scripts/map-structure.sh:20 scripts/map-structure.sh:37 scripts/map-structure.sh:48 scripts/map-structure.sh:58 scripts/map-structure.sh:62 scripts/map-structure.sh:63 scripts/map-structure.sh:64 scripts/map-structure.sh:65 scripts/map-structure.sh:66
⚙️ External commands (50)
scripts/find-entry-points.py:87 scripts/find-entry-points.py:101 scripts/map-structure.sh:10 scripts/map-structure.sh:11 scripts/map-structure.sh:62 scripts/map-structure.sh:63 scripts/map-structure.sh:64 scripts/map-structure.sh:65 scripts/map-structure.sh:66 SKILL.md:34-51 SKILL.md:51-54 SKILL.md:54-70 SKILL.md:70-73 SKILL.md:73-91 SKILL.md:91-96 SKILL.md:96-108 SKILL.md:108-111 SKILL.md:111-127 SKILL.md:127-130 SKILL.md:130-146 SKILL.md:146-151 SKILL.md:151-157 SKILL.md:157-160 SKILL.md:160-163 SKILL.md:163-169 SKILL.md:169-179 SKILL.md:179-182 SKILL.md:182-206 SKILL.md:206-210 SKILL.md:210-224 SKILL.md:224-225 SKILL.md:225-287 SKILL.md:287-294 SKILL.md:294-297 SKILL.md:297-304 SKILL.md:304-307 SKILL.md:307-313 SKILL.md:313-316 SKILL.md:316-322 SKILL.md:322-327 SKILL.md:327-336 SKILL.md:336-339 SKILL.md:339-348 SKILL.md:348-351 SKILL.md:351-360 SKILL.md:360-377 SKILL.md:377-381 SKILL.md:381-382 SKILL.md:382 SKILL.md:393-394
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/c0ntr0lledcha0s-investigating-codebases/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/c0ntr0lledcha0s-investigating-codebases.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
C0ntr0lledCha0s. (2026). investigating-codebases security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9BibTeX citation
@techreport{c0ntr0lledcha0s-c0ntr0lledcha0s-investigating-codebases-2026,
author = {C0ntr0lledCha0s},
title = {investigating-codebases security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "investigating-codebases security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
- name: "C0ntr0lledCha0s"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9"
identifiers:
- type: other
value: "skillstore:c0ntr0lledcha0s-investigating-codebases:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 82
Architecture
100
Maintainability
87
Content
71
Community
83
Spec Compliance
What You Can Build
Understand a New Repository
Map the project, identify entry points, and learn the main architectural conventions before making changes.
Trace a Feature
Follow a feature from its trigger through handlers, services, storage, and response formatting.
Prepare a Technical Review
Document component boundaries, dependencies, data flows, and security-sensitive paths with evidence.
Try These Prompts
Find an Implementation
Find where [feature] is implemented. Name the primary files, explain each role, and include precise file references.
Explain a Component
Explain how [component] works from entry point to output. Trace important calls and data transformations with file references.
Map Repository Architecture
Investigate this repository architecture. Identify entry points, layers, shared modules, integrations, tests, conventions, and important configuration without reading secret values.
Analyze a Cross-Cutting Flow
Trace [workflow] across modules and services. Document branches, validation, state changes, failure handling, security controls, performance concerns, and unresolved questions.
Best Practices
- Start with repository structure and entry points before tracing a specific implementation.
- Verify conclusions across definitions, callers, tests, and configuration files.
- Separate confirmed behavior from assumptions, and cite a file reference for every important claim.
Avoid
- Do not search the entire repository without first defining the feature or workflow boundary.
- Do not infer runtime behavior from names or directory structure alone.
- Do not expose credentials or secret values found in configuration files.
Frequently Asked Questions
Can this skill change the code?
No. Its workflow focuses on reading, searching, tracing, and documenting existing code.
Which languages does it support?
The methodology is general, while bundled entry-point clues cover JavaScript, TypeScript, Python, Go, Rust, Java, and common web frameworks.
Does it run the application or tests?
No. It explains static evidence and does not validate behavior through runtime execution.
Can it trace dependencies?
Yes. It follows imports and related calls, with a helper for local TypeScript, JavaScript, and Python imports.
How are findings presented?
Findings include an overview, key files, implementation steps, execution flow, patterns, related components, and concrete file references.
Will it read environment secrets?
It may identify configuration locations, but users should limit access and request analysis without exposing secret values.
Developer Details
Author
C0ntr0lledCha0sLicense
MIT
Author version
v1.0.0
Skillstore revision
r2
Ref
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
39 downloads · 256 views
File structure