plugins/flow/skills/tracer/SKILL.md
Use when tracing execution paths, mapping dependencies, understanding unfamiliar code, following data flow, investigating end-to-end behavior, debugging call chains, or deciding which files to read next.
npx skillsauth add cofin/flow tracerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Systematic code exploration that builds understanding incrementally by tracing execution paths and mapping dependencies, rather than randomly reading files. Start at a known entry point and follow connections outward, building a map as you go.
<workflow>What's the starting location? An API endpoint, a function call, a config file, a user action. Be specific — "the auth system" is too vague; POST /api/auth/login is an entry point.
Understand what it does. Note every outgoing call or dependency.
Pick the most relevant outgoing connection to follow. Don't try to trace everything at once — choose the branch most likely to answer the question.
Read the next file/function. Note what it calls. Add to the map. Repeat.
Maintain a running trace: A → B → C → D. Include file paths and line numbers.
What to record at each node:
When enough of the system is traced, describe the overall flow. Connect the nodes into a coherent narrative that answers the original question.
When to stop:
Pick the mode based on the question being asked:
| Mode | Question | Best for | |------|----------|----------| | Execution | "What happens when X is called?" | Request flows, feature behavior | | Dependency | "What depends on X?" | Impact analysis, refactoring | | Data | "How does data get from A to B?" | Data pipeline debugging |
For complex investigations, start with execution trace for the happy path, then dependency trace on key components, then data trace on critical structures. See references/trace-modes.md for detailed mode descriptions.
Before presenting the trace, verify:
Trace: "What happens when POST /api/users is called?"
| Node | File | Function | Calls | Data |
|------|------|----------|-------|------|
| 1 | src/routes/users.ts:14 | createUser | UserService.create() | req.body → {name, email} |
| 2 | src/services/user.ts:42 | create() | validate(), UserRepo.insert() | {name, email} → UserDTO |
| 3 | src/repos/user.ts:28 | insert() | db.query() | UserDTO → SQL INSERT |
| 4 | (leaf) | PostgreSQL | — | INSERT INTO users... |
Path: POST /api/users → createUser → UserService.create → UserRepo.insert → SQL INSERT.
development
Use when reviewing authentication, authorization, user input, secrets, API keys, database queries, file uploads, session management, external API calls, OWASP risks, or data handling attack surface.
testing
Use when analyzing tradeoffs, comparing approaches, weighing options, assessing risks, stress-testing conclusions, identifying blind spots, or applying multiple viewpoints to a decision.
development
Use when reviewing hot paths, slow code, database queries, N+1 risks, memory usage, loops, I/O, caching strategy, concurrency, latency-sensitive paths, or resource efficiency.
data-ai
Use when a repository has .agents, when the user asks for Flow lifecycle routing, Beads-backed task memory, spec-first planning, TDD implementation, sync/status, review, finish, archive, or /flow:* help.