hicaosen/code-analyzer
plugins/code-postman/skills/code-analyzer/SKILL.md
代码逆向分析知识库。提供多框架（Express/NestJS/Spring Boot/FastAPI/Django/Gin）的 路由识别、参数提取、校验规则提取、鉴权提取和响应结构提取模式。
development
Updated Apr 28, 2026
$ install --global
skillsauthnpx skillsauth add hicaosen/skills code-analyzerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 28, 2026, 3:46 AM103.1s2 files scanned
SKILL.md
- name:
- code-analyzer
- description:
- >
- user-invocable:
- false
Code Analyzer — 代码逆向分析知识库
本 skill 为 api-testgen agent 的 Phase 1-2 提供代码逆向分析能力。Agent 识别项目类型后，读取对应框架的提取模式。
使用方式
Agent 在分析代码前，先读取 ${CLAUDE_SKILL_DIR}/references/framework-patterns.md，根据识别到的项目类型使用对应章节的提取模式。
分析流程
- 识别项目类型 — 检查配置文件确定语言和框架
- 定位路由 — 使用框架特定的 Grep pattern 找到路由定义
- 提取参数 — 从 handler 函数签名和 decorator 中提取
- 提取校验 — 从 DTO/Model/Schema 中提取字段约束
- 提取鉴权 — 从 middleware/decorator 中提取认证方式
- 提取响应 — 从 return 语句和类型定义中提取响应结构
Related Skills
hicaosen/victoriatraces-api
development
VerifiedTrustedCommunity
VictoriaTraces HTTP API reference for querying distributed traces via Jaeger-compatible API. This skill should be used when searching traces, listing services/operations, getting trace details by ID, querying service dependencies, constructing HTTP requests to VictoriaTraces, or working with Jaeger API endpoints for distributed tracing analysis.
SKILL.mdUpdated Apr 28, 2026
hicaosen/victoriametrics-api
development
VerifiedTrustedCommunity
VictoriaMetrics HTTP API reference for querying metrics, exporting/importing data, TSDB stats, and administrative operations. This skill should be used when constructing HTTP requests to VictoriaMetrics, understanding query endpoints (/api/v1/query, /api/v1/query_range, /api/v1/export, /api/v1/import), response formats, checking cardinality, creating snapshots, or integrating with VictoriaMetrics API.
SKILL.mdUpdated Apr 28, 2026
hicaosen/victorialogs-api
development
VerifiedTrustedCommunity
VictoriaLogs HTTP API reference for querying logs, hits stats, field discovery, live tailing, and log statistics. This skill should be used when constructing HTTP requests to VictoriaLogs, understanding query endpoints (/select/logsql/query, /select/logsql/tail, /select/logsql/hits, /select/logsql/field_names), response formats, or integrating with VictoriaLogs API for log search and analysis.
SKILL.mdUpdated Apr 28, 2026
hicaosen/promql
testing
VerifiedTrustedCommunity
PromQL query language fundamentals for Prometheus and Prometheus-compatible systems. Use for understanding PromQL instant/range vectors, label matchers, aggregation operators, offset/@ modifiers, or when targeting non-VictoriaMetrics Prometheus systems. For VictoriaMetrics-specific features like default_rollup, rollup, or outlier detection, use the metricsql skill.
SKILL.mdUpdated Apr 28, 2026