Codebase Explorer

Analyze unfamiliar codebases and generate structured onboarding guides with architecture maps, entry points, conventions, and project-specific instructions....

Security Scan

The skill's requested capabilities, instructions, and lack of installs/credentials are consistent with its stated purpose of scanning a codebase and producing onboarding artifacts.

Purpose & Capability

Name and description (codebase analysis → onboarding guides) match the instructions and included templates. No unexpected credentials, binaries, or config paths are requested that would be unrelated to repository analysis.

Instruction Scope

SKILL.md and references explicitly instruct selective file scanning (manifests, configs, top-two-level directory mapping, targeted grep/glob). That stays within expected scope. Minor gap: there is no guidance about handling or redacting secrets discovered in repo files—recommendation to explicitly redact or flag secrets would improve safety.

Install Mechanism

Instruction-only skill with no install spec and no code files. Lowest-risk delivery: nothing is written to disk by an install step.

Credentials

No environment variables, credentials, or config paths are requested. This is proportional for a read-only codebase analysis skill.

Persistence & Privilege

always is false and the skill does not request persistent system modifications or cross-skill configuration. Normal autonomous invocation is allowed (platform default) and is not combined with other risky requests.

Assessment

This skill appears coherent with its purpose and is low-risk as provided, but remember: it will read repository files when run. Before granting an agent access to private repos, ensure the repo contains no secrets you don't want inspected. Ask the skill-maker to add explicit redaction/secret-detection guidance (e.g., stop and flag files matching *.env, credentials, .aws/ or .git-credentials) and review any generated CLAUDE.md or onboarding guide before sharing externally.

Codebase Onboarding

Systematically analyze unfamiliar codebases and produce structured onboarding guides.

When to Use

• First time opening a project
• Joining a new team or repository
• User asks "help me understand this codebase"
• User asks to generate a CLAUDE.md for a project
• User says "onboard me" or "walk me through this repo"

Quick Start

1. Scan package manifests and config files (identify tech stack and framework)
2. Map directory structure and entry points (top 2 levels)
3. Trace one request lifecycle (entry → validation → business logic → database)
4. Identify naming, error handling, and testing patterns
5. Generate onboarding guide and starter CLAUDE.md

Key Concepts

• Reconnaissance — Use file presence patterns to infer tech stack and structure
• Architecture pattern — Identify monolith vs. monorepo, frontend/backend split, API style
• Convention detection — Extract naming, error handling, async patterns from recent code
• Guided exploration — Don't read everything; use grep/glob selectively for ambiguity
• Two-artifact output — Onboarding guide (structure + conventions) + CLAUDE.md (project instructions)

Common Usage

Most frequent patterns:

• Understanding project structure and data flow
• Documenting tech stack and architecture
• Creating starter instructions for new team members
• Identifying where to make changes (API routes, UI pages, database, tests)
• Mapping conventions (naming, error handling, git workflow)

References

• references/reconnaissance.md — File patterns for framework/language detection
• references/artifacts.md — Onboarding guide and CLAUDE.md templates, best practices, anti-patterns