affaan-m/repo-scan
skills/repo-scan/SKILL.md
Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.
$ install --global
skillsauthnpx skillsauth add affaan-m/everything-claude-code repo-scanInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 17, 2026, 4:14 AM25.8s1 file scanned
SKILL.md
- name:
- repo-scan
- description:
- Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.
- origin:
- community
repo-scan
Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.
When to Use
- Taking over a large legacy codebase and need a structural overview
- Before major refactoring — identify what's core, what's duplicate, what's dead
- Auditing third-party dependencies embedded directly in source (not declared in package managers)
- Preparing architecture decision records for monorepo reorganization
Installation
# Fetch only the pinned commit for reproducibility
mkdir -p ~/.claude/skills/repo-scan
git init repo-scan
cd repo-scan
git remote add origin https://github.com/haibindev/repo-scan.git
git fetch --depth 1 origin 2742664
git checkout --detach FETCH_HEAD
cp -r . ~/.claude/skills/repo-scan
Review the source before installing any agent skill.
Core Capabilities
| Capability | Description | |---|---| | Cross-stack scanning | C/C++, Java/Android, iOS (OC/Swift), Web (TS/JS/Vue) in one pass | | File classification | Every file tagged as project code, third-party, or build artifact | | Library detection | 50+ known libraries (FFmpeg, Boost, OpenSSL…) with version extraction | | Four-level verdicts | Core Asset / Extract & Merge / Rebuild / Deprecate | | HTML reports | Interactive dark-theme pages with drill-down navigation | | Monorepo support | Hierarchical scanning with summary + sub-project reports |
Analysis Depth Levels
| Level | Files Read | Use Case |
|---|---|---|
| fast | 1-2 per module | Quick inventory of huge directories |
| standard | 2-5 per module | Default audit with full dependency + architecture checks |
| deep | 5-10 per module | Adds thread safety, memory management, API consistency |
| full | All files | Pre-merge comprehensive review |
How It Works
- Classify the repo surface: enumerate files, then tag each as project code, embedded third-party code, or build artifact.
- Detect embedded libraries: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.
- Score each module: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
- Highlight structural risks: call out dead-weight artifacts, duplicated wrappers, outdated vendored code, and modules that should be extracted, rebuilt, or deprecated.
- Produce the report: return a concise summary plus the interactive HTML output with per-module drill-down so the audit can be reviewed asynchronously.
Examples
On a 50,000-file C++ monorepo:
- Found FFmpeg 2.x (2015 vintage) still in production
- Discovered the same SDK wrapper duplicated 3 times
- Identified 636 MB of committed Debug/ipch/obj build artifacts
- Classified: 3 MB project code vs 596 MB third-party
Best Practices
- Start with
standarddepth for first-time audits - Use
fastfor monorepos with 100+ modules to get a quick inventory - Run
deepincrementally on modules flagged for refactoring - Review the cross-module analysis for duplicate detection across sub-projects
Links
- GitHub Repository
Related Skills
affaan-m/unified-memory
development
VerifiedTrustedCommunity
Share durable, inspectable context and handoffs between Claude, Codex, Hermes, Cursor, OpenCode, and other agents through the local ECC Memory Vault. Use when an agent must save work state, transfer context, resume another agent's task, or search shared project knowledge.
234,238SKILL.mdUpdated Jul 28, 2026
affaan-m/contract-first
development
VerifiedTrustedCommunity
Use when multiple consumers and providers must evolve an API or event schema without field drift, integration surprises, or one side silently redefining the interface.
234,238SKILL.mdUpdated Jul 28, 2026
affaan-m/ito-compute
tools
VerifiedTrustedCommunity
Query live GPU inventory, submit an authenticated Itô fixed-rate RFQ, inspect RFQ or procurement status, and run explicitly gated node qualification through the separately installed canonical CLI. Use when a user asks to find H100/H200 capacity, request a fixed compute rate, check Itô compute status, or validate GPU nodes.
234,238SKILL.mdUpdated Jul 24, 2026
affaan-m/continuous-learning-v2
data-ai
VerifiedTrustedCommunity
Instinct-based learning system that observes sessions via hooks, creates atomic instincts with confidence scoring, and evolves them into skills/commands/agents. v2.1 adds project-scoped instincts to prevent cross-project contamination.
234,238SKILL.mdUpdated Mar 27, 2026