Analyze Open Source

v1.0.0

Analyze and explain open-source project code logic, architecture, data flows, APIs, and algorithms. Use when the user asks to analyze a project, understand c...

0· 188·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ttet/analyze-open-source.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Analyze Open Source" (ttet/analyze-open-source) from ClawHub.
Skill page: https://clawhub.ai/ttet/analyze-open-source
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install analyze-open-source

ClawHub CLI

Package manager switcher

npx clawhub@latest install analyze-open-source
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
技能名和描述是“分析开源项目”,SKILL.md 的步骤(读取 README、依赖文件、CI、目录结构、入口文件、代码片段、生成架构/流程图等)都与该目的直接相关。没有要求与任务不符的二进制或凭证,整体能力与目的相符。
Instruction Scope
指令会系统性地读取项目内的多个文件(README、依赖/构建文件、CI 与 Docker 配置、入口点、源代码,按需提取代码片段并引用行号),并要求生成包含代码引用与多个图表的完整报告。这与分析目的合理,但存在信息暴露风险:若仓库包含密钥/凭证/隐私数据或受限源代码,技能会读取并可能在报告中重现这些内容。SKILL.md 还要求全部输出为中文并使用并行子代理(Task tool),这扩大了自动化处理的范围,但并未指示将数据发送到未授权外部端点。
Install Mechanism
这是 instruction-only 技能(无 install 规范、无代码文件要执行)。没有下载或在宿主写入/执行外来二进制的行为,安装风险很低。
Credentials
技能不声明也不需要任何环境变量、凭证或配置路径。SKILL.md 没有引用任何额外的系统环境变量或外部服务凭证,所需权限与分析任务相称。
Persistence & Privilege
flags 显示 always:false(默认)、允许模型调用(正常)。技能不会声明要持久化到系统或修改其他技能配置。没有要求提升持久性或系统级权限。
Assessment
这项技能本身是一个“如何分析仓库”的运行指令集,不会在你的系统上安装额外软件或请求外部凭证。但在使用前请注意: - 不要用它来分析包含秘密(API key、私钥、配置凭证)或私有/受限代码的仓库,技能会读取并可能在报告中直接显示这些内容。 - 报告会摘录代码片段并带行号 —— 如果目标仓库有许可/合规限制或版权顾虑,请先确认是否有权限提取并汇报代码。 - 它要求所有输出为中文(zh-CN),如果你或接收者需要其他语言,需谨慎。 - 虽然技能不会主动把数据发送到第三方,但它使用并行子代理(平台工具)来并行读取与分析,意味着更多自动化访问。确保平台本身的运行环境/审计策略可控并审查生成的输出。 如果你希望更安全地使用:在受控的副本(脱敏或去敏感字段后的仓库)上运行,或先进行一次敏感信息扫描/清理再用该技能。

Like a lobster shell, security has layers — review code before you run it.

latestvk976ktqdpkhv98n9b5qcmgf8xd839sr7
188downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Analyze Open-Source Project

Systematically analyze an open-source project's codebase to help the user quickly understand its architecture, core logic, data flows, key APIs, and algorithm implementations.

All analysis output MUST be in Chinese (zh-CN).

Execution Workflow

Follow these steps strictly in order. Use parallel subagents (Task tool with subagent_type="explore") where noted.

Phase 1: Context Gathering

Read these files first (use parallel reads):

  1. README.md (or README.rst, README.txt) — project purpose, features, quick start
  2. Primary config/dependency file — detect tech stack:
    • Node.js: package.json
    • Python: pyproject.toml > setup.py > requirements.txt
    • Go: go.mod
    • Java/Kotlin: pom.xml or build.gradle
    • Rust: Cargo.toml
    • C/C++: CMakeLists.txt or Makefile
    • .NET: *.csproj or *.sln
  3. CI/Docker files if present (Dockerfile, .github/workflows/) — reveals build & deploy info

Summarize: project name, purpose, tech stack, major dependencies, and build/run commands.

Phase 2: Directory Structure Scan

Run a directory listing (depth 2) to map out the project layout.

Classify each top-level directory into one of:

  • core: main business logic
  • api: HTTP/gRPC/CLI interface layer
  • model/entity: data models or domain objects
  • config: configuration and environment
  • util/common: shared utilities
  • test: test suites
  • docs: documentation
  • scripts/tools: build or deployment scripts
  • other: anything else

Phase 3: Entry Point Identification

Search for program entry points based on the detected tech stack:

Tech StackTypical Entry Points
Node.jspackage.json "main"/"scripts.start", index.js, src/index.ts, app.js
Python__main__.py, main.py, app.py, manage.py, cli.py
Gomain.go, cmd/*/main.go
Javaclasses with public static void main, @SpringBootApplication
Rustsrc/main.rs, src/lib.rs
C/C++main.c, main.cpp
Web Frontendsrc/index.tsx, src/main.ts, src/App.vue

Read the entry point file(s) and trace the initialization/bootstrap sequence.

Phase 4: Deep Analysis

Perform all four dimensions of analysis. Use parallel explore subagents for independent dimensions.

4a. Architecture & Module Dependencies

  • Identify the architectural pattern (MVC, Clean Architecture, Hexagonal, Microservices, Monolith, etc.)
  • Map module dependencies — which modules import/call which
  • Produce a Mermaid graph showing module relationships

4b. Core Business Flow & Data Flow

  • Trace the primary user-facing workflow(s) end-to-end
  • Identify how data enters, transforms, persists, and exits the system
  • Produce a Mermaid flowchart or sequence diagram for the most important flow

4c. Key API Interfaces & Call Chains

  • List public API endpoints or exported interfaces
  • For the top 3-5 most important APIs, trace the call chain from handler to data layer
  • Note middleware, interceptors, or decorators in the chain

4d. Algorithm & Function Implementation

  • Identify non-trivial algorithms or complex business logic
  • Extract the key code snippets (keep concise, max ~30 lines each)
  • Annotate each snippet explaining the logic step by step

Output Format

Use the template defined in template.md to structure the final report.

Key formatting rules:

  • Use Markdown headings (##, ###) for clear hierarchy
  • Include at least 2 Mermaid diagrams (architecture graph + primary flow)
  • Code snippets use CODE REFERENCE format (startLine:endLine:filepath) when citing existing code
  • Keep the entire report readable in under 15 minutes

Guidelines

  • Depth over breadth: It is better to deeply explain 3 critical modules than to shallowly list 20.
  • Follow the data: When in doubt about what to analyze next, follow the data flow.
  • Cite code: Always reference specific files and line numbers — never make vague claims.
  • Be opinionated: State clearly what the architectural strengths and weaknesses are.
  • Progressive disclosure: Start with executive summary; put detailed analysis in later sections. The user should get 80% of the value from the first 20% of the report.

Comments

Loading comments...