oimiragieo/code-analyzer
.claude/skills/code-analyzer/SKILL.md
Static code analysis and complexity metrics
$ install --global
skillsauthnpx skillsauth add oimiragieo/agent-studio code-analyzerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 11, 2026, 2:48 AM10.8s1 file scanned
SKILL.md
- name:
- code-analyzer
- description:
- Static code analysis and complexity metrics
- version:
- 1.1.0
- model:
- sonnet
- invoked_by:
- both
- user_invocable:
- true
- tools:
- [Bash, Read, Glob, Grep]
- error_handling:
- graceful
- streaming:
- supported
- verified:
- true
- lastVerifiedAt:
- 2026-02-22T00:00:00.000Z
Code Analyzer Skill
Installation
No separate download: the skill runs the in-repo tool .claude/tools/analysis/project-analyzer/analyzer.mjs.
- Ensure Node.js (v18+) is installed: nodejs.org or
winget install OpenJS.NodeJS.LTS(Windows),brew install node(macOS). - From the project root, the script is invoked automatically; no extra install steps.
Cheat Sheet & Best Practices
Metrics: Focus on cyclomatic complexity (decision paths), LOC, maintainability index, and duplicate blocks. Use ESLint complexity rule (e.g. "complexity": ["error", 15]) for JS/TS; optional chaining and default params add branches.
Process: Analyze before refactoring; run project-wide then drill into hotspots. Track trends over time (not one-off). Use max-depth, max-lines, max-nested-callbacks, max-params, max-statements alongside complexity.
Hacks: Start with project-analyzer output; filter by file type and threshold. Prioritize files with high complexity and high churn. Disable complexity rule only if you cannot set a sensible limit; prefer lowering the threshold over disabling.
Certifications & Training
No single cert; aligns with static analysis and ESLint complexity. ESLint: complexity rule, max-depth, max-lines, max-params. Skill data: Cyclomatic complexity, LOC, maintainability, duplicates; analyze before refactor; track hotspots and trends.
Hooks & Workflows
Suggested hooks: Pre-commit or CI: run project-analyzer/doctor for health; optional complexity gate. Use with developer (secondary), qa (secondary), code-reviewer (primary).
Workflows: Use with code-reviewer (primary), developer/ qa (secondary), c4-code (primary). Flow: run analyzer → filter hotspots → refactor or add tests. See code-review-workflow.md.
Overview
Static code analysis and metrics. 90%+ context savings.
Tools (Progressive Disclosure)
Analysis
| Tool | Description | | --------------- | ---------------------------- | | analyze-file | Analyze single file | | analyze-project | Analyze entire project | | complexity | Calculate complexity metrics |
Metrics
| Tool | Description | | --------------- | --------------------- | | loc | Lines of code | | cyclomatic | Cyclomatic complexity | | maintainability | Maintainability index | | duplicates | Find duplicate code |
Reporting
| Tool | Description | | -------- | ------------------------ | | summary | Get analysis summary | | hotspots | Find complexity hotspots | | trends | Analyze metric trends |
Agent Integration
- code-reviewer (primary): Code review
- refactoring-specialist (primary): Tech debt analysis
- architect (secondary): Architecture assessment
Iron Laws
- ALWAYS run project-wide analysis before drilling into individual files — local analysis without context misses which files are actually the highest-priority hotspots; start broad, then focus.
- ALWAYS focus on high-complexity AND high-churn files — a complex but rarely-changed file is lower priority than a moderately complex but frequently-changed one; intersection matters most.
- NEVER set complexity thresholds above 20 — cyclomatic complexity >20 is demonstrably correlated with defects; teams that allow >20 accumulate unmaintainable code without noticing.
- ALWAYS track metrics over time, not just once — a single analysis snapshot is meaningless; track trends weekly to detect gradual degradation before it becomes a crisis.
- NEVER report metrics without actionable next steps — complexity numbers without refactoring targets provide no value; every high-complexity finding must include a specific suggested improvement.
Anti-Patterns
| Anti-Pattern | Why It Fails | Correct Approach | | ------------------------------------------ | ------------------------------------------------------- | ----------------------------------------------------- | | Analyzing only changed files | Misses cross-file complexity accumulation | Run project-wide then filter to changed hot spots | | Ignoring high-complexity files over time | Gradual degradation invisible in point-in-time analysis | Track weekly trends; alert on any increase | | Complexity threshold >20 | Research shows defect rate spikes sharply above 20 | Set ESLint complexity rule to ≤15 for enforcement | | Reporting metrics without action items | Metrics without remediation don't reduce complexity | Attach specific refactoring suggestion per hotspot | | Running analysis once and ignoring results | Technical debt silently accumulates | Schedule automated weekly analysis with trend reports |
Memory Protocol (MANDATORY)
Before starting:
Read .claude/context/memory/learnings.md
After completing:
- New pattern ->
.claude/context/memory/learnings.md - Issue found ->
.claude/context/memory/issues.md - Decision made ->
.claude/context/memory/decisions.md
ASSUME INTERRUPTION: If it's not in memory, it didn't happen.
Related Skills
oimiragieo/neurokit2
tools
VerifiedTrustedCommunity
Comprehensive biosignal processing toolkit for analyzing physiological data including ECG, EEG, EDA, RSP, PPG, EMG, and EOG signals. Use this skill when processing cardiovascular signals, brain activity, electrodermal responses, respiratory patterns, muscle activity, or eye movements. Applicable for heart rate variability analysis, event-related potentials, complexity measures, autonomic nervous system assessment, psychophysiology research, and multi-modal physiological signal integration.
24SKILL.mdUpdated Apr 15, 2026
oimiragieo/networkx
tools
VerifiedTrustedCommunity
Comprehensive toolkit for creating, analyzing, and visualizing complex networks and graphs in Python. Use when working with network/graph data structures, analyzing relationships between entities, computing graph algorithms (shortest paths, centrality, clustering), detecting communities, generating synthetic networks, or visualizing network topologies. Applicable to social networks, biological networks, transportation systems, citation networks, and any domain involving pairwise relationships.
24SKILL.mdUpdated Apr 15, 2026
oimiragieo/molfeat
data-ai
VerifiedTrustedCommunity
Molecular featurization for ML (100+ featurizers). ECFP, MACCS, descriptors, pretrained models (ChemBERTa), convert SMILES to features, for QSAR and molecular ML.
24SKILL.mdUpdated Apr 15, 2026
oimiragieo/modal
development
VerifiedTrustedCommunity
Run Python code in the cloud with serverless containers, GPUs, and autoscaling. Use when deploying ML models, running batch processing jobs, scheduling compute-intensive tasks, or serving APIs that require GPU acceleration or dynamic scaling.
24SKILL.mdUpdated Apr 15, 2026