Results for “codebase analysis”

Inspect codebases w/ pygount: LOC, languages, ratios.

The English summary is being prepared. Showing the original description.

Analyze any codebase's source code in depth and produce structured analysis documents saved as markdown files. Use this skill whenever the user asks to understand how a codebase works — architecture, module design, call flows, data models, design patterns, performance characteristics, or any implementation detail. Trigger on phrases like "analyze the source", "explain this code", "how does X work", "where is Y implemented", "trace the flow of", "what happens when", "read through the code", "code walkthrough", "源码分析", "代码解读", "实现原理", "架构分析", "调用链路", "模块分析", or any code-exploration request. Works with any programming language: TypeScript/JavaScript, Java, Python, Go, Rust, C/C++, and more. Even if the user's question seems simple (e.g., "这个文件是干什么的"), use this skill — a thorough, source-backed analysis document is always more valuable than a surface-level guess.

The English summary is being prepared. Showing the original description.

Understand a codebase before searching for bugs or vulnerabilities. This skill examines functions line by line, documents assumptions and state changes, and traces calls across modules to build an evidence-based picture of system behavior.

• Understanding a codebase before a security audit
• Tracing data and state changes across function calls
• Documenting assumptions for an architecture review

Analyze Antigravity coding session artifacts to explain scope changes, repeated rework, and underlying causes. Produce an evidence-based report with confidence levels, prompt assessments, recurring problem areas, and prioritized recommendations for improving future development sessions.

• Reviewing sessions with repeated rework
• Separating scope changes from agent and codebase problems
• Finding files and subsystems associated with recurring friction

Investigate bugs and slow applications through reproducible examples, logs, environment comparisons, and hypothesis testing. The skill structures root cause analysis and performance measurement, helping developers narrow down failures and verify that a fix works.

• Investigate bugs that occur only occasionally
• Measure and locate performance bottlenecks
• Collect evidence and reproduce production failures

Assess potential data breach impact by reviewing sensitive data and its movement through a codebase. Produce an inventory, exposure rankings, financial estimates, and prioritized safeguards, distinguishing legal source figures from planning estimates.

• Inventory sensitive data before a security review
• Trace where customer data could leak
• Estimate breach impact and costs for planning

Create an evidence-based plan for modernizing an existing system. Analyze code and dependencies, research technology choices, and produce domain-specific migration plans with testing, rollback steps, and a consolidated roadmap for developers to execute.

• Planning a gradual replacement of a legacy system
• Comparing service separation and consolidation strategies
• Preparing a language or framework migration

Find unused functions through static analysis, which examines code without running it. Scan a project or directory, choose a language, and exclude designated entry points to get a list of functions with file locations.

• Listing unused functions across a project
• Checking a specific directory before cleanup
• Excluding entry points and handlers from analysis

Review code that has not yet been checked by forming security hypotheses and testing them with analysis tools. The skill records evidence, checks whether affected code is reachable, searches for related patterns, and preserves review progress across sessions.

• Reviewing code that has not yet received security checks
• Testing suspected vulnerabilities with analysis tools
• Searching the codebase for patterns behind confirmed findings

Use Ontoly's deterministic Software Graph and MCP server for codebase architecture, request tracing, dependency analysis, and impact analysis.

The English summary is being prepared. Showing the original description.

Conducts multi-turn iterative deep research on specific topics within a codebase with zero tolerance for shallow analysis. Use when the user wants an in-depth investigation, needs to understand how something works across multiple files, or asks for comprehensive analysis of a specific system or pattern.

The English summary is being prepared. Showing the original description.

Convention discovery and rule generation from codebase analysis. Scans project structure, builds search indexes, identifies patterns, and generates enforceable rules.

The English summary is being prepared. Showing the original description.

Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user wants to "fix everything", "sweep the codebase", "auto-fix all issues", "clean up the whole project", or asks for a single command that both diagnoses and remediates quality problems. Do NOT trigger for: read-only audits or health reports where the user only wants findings without code changes; single-dimension reviews (use the focused skill instead: brooks-review / brooks-audit / brooks-debt / brooks-test); server health checks, HTTP /health endpoints, Kubernetes probes, database health, or application uptime.

The English summary is being prepared. Showing the original description.

Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/businesslogic-results.md. Use when asked to find business logic, logic flaws, or abuse-of-function bugs.

The English summary is being prepared. Showing the original description.

Migrate, modernize, and upgrade codebases to AWS. Run analysis on repos for tech debt, security vulnerabilities, and modernization opportunities. Transforms .NET Framework to .NET 8/10, mainframe COBOL to Java, VMware VMs to EC2, SQL Server to Aurora, and upgrades Java/Python/Node.js versions and AWS SDKs. Use when the user says "migrate .NET to AWS", "upgrade Java to 17/21", "modernize COBOL", "modernize mainframe", "move VMware to EC2", "convert SQL Server to Aurora", "upgrade Python version", "migrate AWS SDK", "transform this codebase", "analyze for issues", "find tech debt", "what tech debt", "security vulnerabilities", "CVEs", "what's wrong with my code", "assess my repos", "where do I start", "find what's outdated", "analyze my repos", "AWS Transform - continuous modernization", "continuous modernization" or "continuous-modernization". Don't use for infrastructure provisioning, CI/CD pipelines, or general coding tasks.

The English summary is being prepared. Showing the original description.

Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess test coverage, or get a codebase health check.

The English summary is being prepared. Showing the original description.

Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.

The English summary is being prepared. Showing the original description.

Assessment: read-only inspection, codebase overview, value analysis, health checks, ADR consultation, decision analysis, multi-perspective critique.

The English summary is being prepared. Showing the original description.

Analyze a codebase and produce a structured threat model at .turbo/threat-model.md covering assets, trust boundaries, attack surfaces with existing mitigations, attacker stories, and calibrated severity. Use when the user asks to "create a threat model", "threat model", "threat model this codebase", "security analysis", "analyze the attack surface", "what are the threats", or "identify security risks".

The English summary is being prepared. Showing the original description.

Provides Gemini CLI delegation workflows for large-context analysis and complex reasoning using Gemini 3.0 Flash and Gemini 3.0 Pro models, including English prompt formulation, execution flags, and safe result handling. Use when the user explicitly asks to use Gemini for tasks such as broad codebase analysis, fast iterations with Gemini 3 Flash, or deep architectural reasoning with Gemini 3 Pro. Triggers on "use gemini", "delegate to gemini", "run gemini cli", "ask gemini", "use gemini for this task", "use gemini 3 flash", "use gemini 3 pro".

The English summary is being prepared. Showing the original description.

Detects codebase bloat via dead code, duplication, complexity, and doc bloat scans. Use when codebase feels large or before a release.

The English summary is being prepared. Showing the original description.

Generate project-specific AGENTS.md and companion rules by analyzing a codebase. Supports full, minimal, update, and dry-run modes with package-manager detection, monorepos, backups, managed blocks, confidence scoring, and command validation.

The English summary is being prepared. Showing the original description.

Assesses production readiness or audits a codebase against its specs. Supports quick static mode, deep 17-dimension audit, or single-dimension focus. Use before a production launch, after a major refactor, when inheriting a codebase, or when someone asks how done the project is.

The English summary is being prepared. Showing the original description.

Pre-change blast-radius report for a symbol or file. Walks tree-sitting references, augments with a plain-text scan over non-parsed files (configs, plain docs), and clusters affected sites by feature (`_FEATURES.md`) or top-level package. Use when about to refactor, rename, or delete something in a repo you don't own — "what breaks if I change `validateUser`", "who calls this", "is this safe to remove", "where is this used", "blast radius", "impact analysis". This is the CONVERGENT pre-change risk skill — for "what is this repo?" use exploring-codebases; for "where is X?" use searching-codebases.

The English summary is being prepared. Showing the original description.