# Analyze Unfamiliar Codebases Systematically

Unfamiliar codebases hide entry points, dependencies, architecture, and technical debt. This skill provides a structured workflow for tracing and documenting those elements.

## Install

```bash
npx skillstore add consiliency/codebase-analysis
```

## Metadata

- Status: approved
- Slug: consiliency-codebase-analysis
- Skillstore revision: r1
- Version status: missing
- Tree hash: 846f228de3fc735f25e4ef66b2359b32706be30eb9556b41e983f376485026c3
- Author: Consiliency
- GitHub username: Consiliency
- License: MIT
- Repository: https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/codebase-analysis
- Ref: 635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/consiliency-codebase-analysis
- Manifest: https://skillstore.pages.dev/api/skills/consiliency-codebase-analysis/manifest

## Capabilities

- Discovers likely entry points across JavaScript, TypeScript, Python, Go, Java, Rust, Dart, C, and C\+\+ projects.
- Traces imports, exported symbols, module relationships, package dependencies, call paths, and circular dependencies.
- Infers architecture patterns from directories, imports, framework conventions, and dependency flow.
- Identifies code, test, dependency, documentation, and architecture debt using defined severity levels.
- Produces structured reports with overviews, entry points, dependencies, diagrams, and prioritized debt.

## Use Cases

- Orient a New Contributor: Map entry points, framework conventions, and important dependency paths before assigning the first change.
- Prepare a Refactoring Plan: Trace component boundaries and circular dependencies before changing a fragile subsystem.
- Prioritize Technical Debt: Build an evidence-based inventory of quality, testing, dependency, documentation, and architecture issues.

## Prompt Templates

### Run a Quick Orientation

```
Analyze this repository at quick depth. Identify its language, framework, configuration files, and main entry points. Cite evidence for every conclusion.
```

### Trace an Entry Point

```
Start from [entry point] and trace direct and transitive dependencies. Highlight external packages, circular references, and uncertain links. Do not modify files.
```

### Review the Architecture

```
Perform a standard architecture review of [repository]. Detect primary and secondary patterns from structure and imports. Explain conflicting evidence and produce a dependency diagram.
```

### Plan a High-Risk Refactor

```
Perform a deep analysis of [component]. Map entry points, call paths, ownership boundaries, and debt. Rank refactoring risks and propose verification steps.
```

## Limitations

- Architecture detection uses heuristics, so conclusions require verification against source behavior.
- Shell examples assume common Unix tools and may need adaptation on Windows.
- Several debt checks focus on JavaScript and TypeScript, while other languages receive less coverage.
- Optional commands can execute repository scripts or download npm packages and require review before use.

## Best Practices

- Begin with confirmed entry points and trace dependencies outward.
- Confirm architecture patterns using both directory structure and import direction.
- Request approval before commands that run project scripts or download tools.

## Anti Patterns

- Do not infer architecture from directory names alone.
- Do not run package scripts or npx tools in untrusted repositories without approval.
- Do not report debt without evidence, locations, severity, and impact.

## Security Audit

- Audited at: 2026-07-13T15:52:03.756\+00:00
- Summary: Most static findings are false positives caused by Markdown code formatting, repository-local discovery commands, and /dev/null redirection. Two intent-level risks remain: a repository-defined npm script and unpinned npx packages can execute untrusted code. No prompt injection, credential access, exfiltration, or suspicious network destination was found.

## Stats

- Views: 231
- Downloads: 15
- Favorites: 2
- Popularity score: 0