# Analyze Existing Codebases in Depth

Existing codebases often lack a clear view of architecture, quality risks, and technical debt. This skill combines repository inspection with focused research and produces a prioritized Markdown report.

## Install

```bash
npx skillstore add cubha/analyze
```

## Metadata

- Status: approved
- Slug: cubha-analyze
- Skillstore revision: r2
- Version status: missing
- Tree hash: a2b60375bd031b8e174f097998351806ec7bb1de75ee52f4da5af9266ee3437e
- Author: cubha
- GitHub username: cubha
- License: MIT
- Repository: https://github.com/cubha/claude-workflow-plugins/tree/3172e1a00f7090579f36af20c046828489983c23/plugins/analyze/skills/analyze
- Ref: c43861a65bb95efcae259cd161c9d6f4dc7eec6f
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 77
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/cubha-analyze
- Manifest: https://skillstore.pages.dev/api/skills/cubha-analyze/manifest

## Capabilities

- Inspects project documentation, dependencies, structure, entry points, modules, configuration, and major import relationships.
- Runs parallel analyses for repository structure, architecture, and high-confidence code quality issues.
- Reviews security, performance, technical debt, testing, error handling, and convention consistency.
- Researches current guidance for three to five core technologies and relevant domain practices.
- Creates a dated Markdown report with evidence, assessments, sources, and a prioritized improvement roadmap.
- Supports architecture-only, quality-only, no-research, and terminal-output modes.

## Use Cases

- Audit a Legacy Service: Identify structural weaknesses, risky dependencies, technical debt, and practical improvements before maintaining or modernizing a legacy service.
- Plan Engineering Improvements: Create an evidence-based roadmap that separates immediate fixes, short-term work, and longer architectural changes.
- Assess Project Health: Summarize implementation maturity, stack suitability, security concerns, performance risks, and current technology guidance for planning decisions.

## Prompt Templates

### Run a Full Analysis

```
Analyze the existing codebase at {project_path}. Summarize its architecture, code quality, security, performance, technical debt, and prioritized improvements.
```

### Review Architecture

```
Analyze {project_path} with --arch-only. Explain layers, data flow, module dependencies, patterns, scalability, and testability with file evidence.
```

### Audit Code Quality

```
Analyze {project_path} with --quality-only. Focus on {risk_area}, testing gaps, error handling, performance bottlenecks, and high-confidence security issues.
```

### Build a Research-Grounded Roadmap

```
Analyze {project_path} for {business_context}. Focus on {priority_risks}, reuse existing research, compare {core_technologies} with current guidance, and create a phased roadmap.
```

## Limitations

- Requires an existing codebase and is not designed for greenfield project planning.
- Depends on available Read, Glob, task-agent, Context7, WebSearch, Write, and Bash capabilities.
- Findings are analysis outputs and may require human validation before implementation.
- External research is limited to core technologies and selected domain topics.

## Best Practices

- Run the skill from the project root so dependencies, documentation, and source paths resolve correctly.
- State the analysis priority and project context in the request to improve relevance.
- Review evidence and cited sources before scheduling roadmap work.

## Anti Patterns

- Do not use this skill to design a project that has no existing code.
- Do not include secrets or credentials in prompts, repository notes, or generated reports.
- Do not treat every automated finding as confirmed without checking the referenced code.

## Security Audit

- Audited at: 2026-07-23T12:52:05.175\+00:00
- Summary: All 33 external-command alerts are false positives caused by Markdown fences or inline code. The entropy alert reflects readable Korean documentation, not obfuscation. No malicious command behavior or prompt injection was found.

## Stats

- Views: 0
- Downloads: 6
- Favorites: 1
- Popularity score: 0