Source profileQuality 91/100Review permissions

affaan-m/ECC/skills/repo-scan/SKILL.md

repo-scan

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.

Source repository stars
234,327
Declared platforms
0
Static risk flags
3
Last source update
2026-07-27
Source checked
2026-07-28

Decision brief

What it does—and where it fits

Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.

Best for

  • Taking over a large legacy codebase and need a structural overview
  • Before major refactoring — identify what's core, what's duplicate, what's dead
  • Auditing third-party dependencies embedded directly in source (not declared in package managers)

Not for

  • Tasks that require unconfirmed production actions or broad system permissions.
  • Environments where the pinned source and install steps cannot be inspected.

Compatibility matrix

Platform support, with evidence labels

PlatformStatusEvidenceWhat to check
CodexNot declaredNo explicit evidencePortability before use
Claude CodeNot declaredNo explicit evidencePortability before use
CursorNot declaredNo explicit evidencePortability before use
Gemini CLINot declaredNo explicit evidencePortability before use
Open the compatibility checker

Installation

Inspect first. Install second.

The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

Source-detected install commandSource
npx skills add https://github.com/affaan-m/ECC --skill "skills/repo-scan"
Safe inspection promptEditorial

Inspect the Agent Skill "repo-scan" from https://github.com/affaan-m/ECC/blob/4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38/skills/repo-scan/SKILL.md at commit 4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

Workflow

What the source asks the agent to do

  1. 01

    When to Use

    Taking over a large legacy codebase and need a structural overview

    Taking over a large legacy codebase and need a structural overviewBefore major refactoring — identify what's core, what's duplicate, what's deadAuditing third-party dependencies embedded directly in source (not declared in package managers)
  2. 02

    Installation

    Review the “Installation” section in the pinned source before continuing.

    Review and apply the “Installation” source section.
  3. 03

    Fetch only the pinned commit for reproducibility

    mkdir -p /.claude/skills/repo-scan git init repo-scan cd repo-scan git remote add origin https://github.com/haibindev/repo-scan.git git fetch --depth 1 origin 2742664 git checkout --detach FETCHHEAD cp -r . /.claude/skills/repo-scan

    Classify the repo surface: enumerate files, then tag each as project code, embedded third-party code, or build artifact.Detect embedded libraries: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.Score each module: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
  4. 04

    Core Capabilities

    Review the “Core Capabilities” section in the pinned source before continuing.

    Review and apply the “Core Capabilities” source section.

Permission review

Static risk signals and limitations

Runs scripts

medium · line 17

The documentation asks the agent to run terminal commands or scripts.

git init repo-scan

Network access

medium · line 19

The documentation includes network, browsing, or remote request actions.

git remote add origin https://github.com/haibindev/repo-scan.git

Runs scripts

medium · line 19

The documentation asks the agent to run terminal commands or scripts.

git remote add origin https://github.com/haibindev/repo-scan.git

Reads files

low · line 50

The documentation asks the agent to read local files, directories, or repositories.

**Detect embedded libraries**: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.

Evidence record

Why each signal appears

EvidenceSourceComputedTestedEditorial
SignalValueEvidence typeMeaning
Quality score91/100ComputedDocumentation, specificity, maintenance, and trust rules
Repository stars234,327SourceRepository attention, not individual Skill quality
Compatibility0 platformsSourceDeclared in the catalog source record
Usage guideautomated source guideEditorialGenerated or reviewed according to the visible evidence level

Pinned source

Provenance and original SKILL.md

Repository
affaan-m/ECC
Skill path
skills/repo-scan/SKILL.md
Commit
4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38
License
MIT
Collected
2026-07-28
Default branch
main
View the original SKILL.md

repo-scan

Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.

When to Use

  • Taking over a large legacy codebase and need a structural overview
  • Before major refactoring — identify what's core, what's duplicate, what's dead
  • Auditing third-party dependencies embedded directly in source (not declared in package managers)
  • Preparing architecture decision records for monorepo reorganization

Installation

# Fetch only the pinned commit for reproducibility
mkdir -p ~/.claude/skills/repo-scan
git init repo-scan
cd repo-scan
git remote add origin https://github.com/haibindev/repo-scan.git
git fetch --depth 1 origin 2742664
git checkout --detach FETCH_HEAD
cp -r . ~/.claude/skills/repo-scan

Review the source before installing any agent skill.

Core Capabilities

CapabilityDescription
Cross-stack scanningC/C++, Java/Android, iOS (OC/Swift), Web (TS/JS/Vue) in one pass
File classificationEvery file tagged as project code, third-party, or build artifact
Library detection50+ known libraries (FFmpeg, Boost, OpenSSL…) with version extraction
Four-level verdictsCore Asset / Extract & Merge / Rebuild / Deprecate
HTML reportsInteractive dark-theme pages with drill-down navigation
Monorepo supportHierarchical scanning with summary + sub-project reports

Analysis Depth Levels

LevelFiles ReadUse Case
fast1-2 per moduleQuick inventory of huge directories
standard2-5 per moduleDefault audit with full dependency + architecture checks
deep5-10 per moduleAdds thread safety, memory management, API consistency
fullAll filesPre-merge comprehensive review

How It Works

  1. Classify the repo surface: enumerate files, then tag each as project code, embedded third-party code, or build artifact.
  2. Detect embedded libraries: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.
  3. Score each module: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
  4. Highlight structural risks: call out dead-weight artifacts, duplicated wrappers, outdated vendored code, and modules that should be extracted, rebuilt, or deprecated.
  5. Produce the report: return a concise summary plus the interactive HTML output with per-module drill-down so the audit can be reviewed asynchronously.

Examples

On a 50,000-file C++ monorepo:

  • Found FFmpeg 2.x (2015 vintage) still in production
  • Discovered the same SDK wrapper duplicated 3 times
  • Identified 636 MB of committed Debug/ipch/obj build artifacts
  • Classified: 3 MB project code vs 596 MB third-party

Best Practices

  • Start with standard depth for first-time audits
  • Use fast for monorepos with 100+ modules to get a quick inventory
  • Run deep incrementally on modules flagged for refactoring
  • Review the cross-module analysis for duplicate detection across sub-projects

Links

Alternatives

Compare before choosing