Skills codebase-analysis
📦
codebase-analysis
Content revision r1 High Risk ⚙️ External commands📁 Filesystem access
Analyze Unfamiliar Codebases Systematically
Unfamiliar codebases hide entry points, dependencies, architecture, and technical debt. This skill provides a structured workflow for tracing and documenting those elements.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "codebase-analysis" from https://skillstore.io/skills/consiliency-codebase-analysis.md and its manifest at https://skillstore.io/api/skills/consiliency-codebase-analysis/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "codebase-analysis". Give me a quick assessment of this TypeScript service.
Expected outcome:
- Overview: The project is a TypeScript HTTP service with one application bootstrap and separate route modules.
- Entry points: The package manifest identifies the main runtime file, while the server module starts request handling.
- Next step: Trace imports from the server module before classifying the architecture.
Using "codebase-analysis". Trace dependencies from the authentication service.
Expected outcome:
- Direct dependencies: database access, password hashing, token creation, and user lookup modules.
- Inbound dependencies: login routes and authentication middleware call the service.
- Risk: A circular reference between user lookup and authentication needs source verification.
Using "codebase-analysis". Identify and prioritize technical debt before a refactor.
Expected outcome:
- High: A large service owns unrelated account, billing, and notification behavior.
- Medium: Critical API paths have limited tests and several outdated dependencies.
- Recommended order: Add behavior tests, split responsibilities, then update dependencies.
Security Audit
High Riskv10 • 7/13/2026 Open versioned report
Most static findings are false positives caused by Markdown code formatting, repository-local discovery commands, and /dev/null redirection. Two intent-level risks remain: a repository-defined npm script and unpinned npx packages can execute untrusted code. No prompt injection, credential access, exfiltration, or suspicious network destination was found.
6
Files scanned
1,037
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Repository-Defined Script Execution
The cookbook recommends npm run test:coverage in unfamiliar repositories. Repository-controlled npm scripts can execute arbitrary commands with the agent's permissions.
The cited command directly invokes an npm script whose implementation is controlled by the repository being analyzed.
Medium
cookbook/debt-identification.md:67cookbook/debt-identification.md:110cookbook/dependency-tracing.md:34cookbook/dependency-tracing.md:128
Unpinned npx Package Execution
The cookbooks recommend unpinned npx invocations. npx may download and execute registry packages when the requested tools are absent.
Each cited command uses npx without an exact package version or a no-install safeguard.
Risk Factors
⚙️ External commands (37)
cookbook/debt-identification.md:141-147 cookbook/debt-identification.md:147-148 cookbook/debt-identification.md:148-149 cookbook/debt-identification.md:149-157 cookbook/debt-identification.md:25 cookbook/debt-identification.md:71 cookbook/dependency-tracing.md:159-160 cookbook/dependency-tracing.md:160-161 cookbook/dependency-tracing.md:161-164 cookbook/dependency-tracing.md:164-165 cookbook/dependency-tracing.md:165-171 cookbook/entry-point-discovery.md:179-180 cookbook/entry-point-discovery.md:180-181 cookbook/entry-point-discovery.md:181-182 cookbook/pattern-detection.md:151 cookbook/pattern-detection.md:159-160 cookbook/pattern-detection.md:160-168 SKILL.md:14 SKILL.md:15 SKILL.md:40 SKILL.md:51 SKILL.md:56 SKILL.md:61 SKILL.md:66 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:81 SKILL.md:87 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:96-106 SKILL.md:106-107 SKILL.md:107-119
📁 Filesystem access (24)
cookbook/debt-identification.md:25 cookbook/debt-identification.md:30 cookbook/debt-identification.md:57 cookbook/debt-identification.md:67 cookbook/debt-identification.md:71 cookbook/entry-point-discovery.md:20 cookbook/entry-point-discovery.md:40 cookbook/entry-point-discovery.md:59 cookbook/entry-point-discovery.md:71 cookbook/entry-point-discovery.md:74 cookbook/entry-point-discovery.md:75 cookbook/entry-point-discovery.md:102 cookbook/entry-point-discovery.md:105 cookbook/entry-point-discovery.md:115 cookbook/entry-point-discovery.md:118 cookbook/entry-point-discovery.md:129 cookbook/entry-point-discovery.md:167 cookbook/pattern-detection.md:11 cookbook/pattern-detection.md:24 cookbook/pattern-detection.md:36 cookbook/pattern-detection.md:49 cookbook/pattern-detection.md:62 cookbook/pattern-detection.md:83 cookbook/pattern-detection.md:99
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/consiliency-codebase-analysis/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/consiliency-codebase-analysis?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/consiliency-codebase-analysis?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/consiliency-codebase-analysis/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/consiliency-codebase-analysis.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Consiliency. (2026). codebase-analysis security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/consiliency-codebase-analysis/audits/10BibTeX citation
@techreport{consiliency-consiliency-codebase-analysis-2026,
author = {Consiliency},
title = {codebase-analysis security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/consiliency-codebase-analysis/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "codebase-analysis security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "Consiliency"
date-released: "2026-07-13"
url: "https://skillstore.io/skills/consiliency-codebase-analysis/audits/10"
identifiers:
- type: other
value: "skillstore:consiliency-codebase-analysis:audit:10"
description: "Skillstore immutable audit report identifier"
Compare variants
3 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Highest Skillstore Score
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
AI-Vibe-Prompts Recommended
atman36-codebase-analysis
Skillstore Score 80
Evidence Confidence High
Skillstore usage 9
Updated
2026-08-21
doubleslashse-codebase-analysis
Skillstore Score 79
Evidence Confidence High
Skillstore usage 11
Updated
2026-08-21
Consiliency Current
consiliency-codebase-analysis
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 15
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Orient a New Contributor
Map entry points, framework conventions, and important dependency paths before assigning the first change.
Prepare a Refactoring Plan
Trace component boundaries and circular dependencies before changing a fragile subsystem.
Prioritize Technical Debt
Build an evidence-based inventory of quality, testing, dependency, documentation, and architecture issues.
Try These Prompts
Run a Quick Orientation
Analyze this repository at quick depth. Identify its language, framework, configuration files, and main entry points. Cite evidence for every conclusion.
Trace an Entry Point
Start from [entry point] and trace direct and transitive dependencies. Highlight external packages, circular references, and uncertain links. Do not modify files.
Review the Architecture
Perform a standard architecture review of [repository]. Detect primary and secondary patterns from structure and imports. Explain conflicting evidence and produce a dependency diagram.
Plan a High-Risk Refactor
Perform a deep analysis of [component]. Map entry points, call paths, ownership boundaries, and debt. Rank refactoring risks and propose verification steps.
Best Practices
- Begin with confirmed entry points and trace dependencies outward.
- Confirm architecture patterns using both directory structure and import direction.
- Request approval before commands that run project scripts or download tools.
Avoid
- Do not infer architecture from directory names alone.
- Do not run package scripts or npx tools in untrusted repositories without approval.
- Do not report debt without evidence, locations, severity, and impact.
Frequently Asked Questions
Which languages and frameworks are supported?
The references cover major JavaScript, Python, Go, Java, Rust, Dart, C, C++, and Ruby entry-point conventions.
Does the skill modify source files?
The workflow requests analysis and reports, not source edits. Some optional commands can execute project tooling and need approval.
Can it generate architecture diagrams?
Yes. The report format supports dependency diagrams and optional C4 diagrams when requested.
How reliable are the architecture conclusions?
They are heuristic conclusions. Verify them against imports, runtime entry points, and source behavior before making design decisions.
Which local tools may be needed?
Examples use grep, ripgrep, find, jq, package managers, and optional dependency-analysis tools.
Is it suitable for untrusted repositories?
Use read-only inspection first. Skip npm scripts and npx downloads unless a sandbox or explicit approval is available.
Developer Details
Author
ConsiliencyLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/codebase-analysisRef
635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
Maintenance freshness
7/18/2026
Usage
11 downloads · 231 views
File structure