codebase-stats

Analyze project metrics: lines of code, language distribution, function complexity, code-to-comment ratio, test coverage indicators, dependency counts, large...

Security Scan

The skill's code and instructions are consistent with a local, file-system based codebase metrics tool and do not request unrelated credentials or network installs, but I could not fully verify the truncated source and you should review/run it in isolation before trusting it with sensitive repositories.

Purpose & Capability

Name/description match the included Python scanner. The script implements LOC, language detection, simple complexity heuristics, dependency counts, and TODO/FIXME scanning — all expected for a 'codebase-stats' tool. No unrelated credentials, binaries, or cloud access are requested.

Instruction Scope

SKILL.md instructs running the included Python script on a target directory and offers output formats (markdown/json). The runtime instructions and the script operate on repository files and manifest files only; they do not instruct the agent to read unrelated system config or call external endpoints.

Install Mechanism

No install specification and the tool is pure Python with no external dependencies per SKILL.md and the script header. This reduces risk because nothing is downloaded or written to disk beyond running the provided script.

Credentials

The skill requires no environment variables, credentials, or special config paths. The script reads local project files (package.json, requirements.txt, go.mod, Cargo.toml, source files) which is appropriate for its purpose.

Persistence & Privilege

The skill is not always-on and uses normal model invocation. It does not appear to modify agent/system configuration or request persistent privileges.

Assessment

The tool appears coherent and limited to local repository analysis, but it reads many files in the target directory — do not run it directly on repositories containing secrets or private credentials. Because the provided source in the prompt was truncated, review the full script before use (search for any network/socket/file-write code or subprocess.exec calls). Run it in an isolated environment or on a copy of the repo first, and inspect reported outputs to ensure no sensitive content is included in generated reports.

Project metrics, complexity analysis, and health indicators. Pure Python, zero deps, 40+ languages.

Quick Start

# Analyze current directory
python3 scripts/codebase_stats.py

# Analyze specific project
python3 scripts/codebase_stats.py /path/to/project

# Markdown report
python3 scripts/codebase_stats.py /path/to/project --format markdown

# JSON (for CI/CD dashboards)
python3 scripts/codebase_stats.py /path/to/project --format json

# Filter by language
python3 scripts/codebase_stats.py --language Python

# Save report
python3 scripts/codebase_stats.py --format markdown --output stats.md

What It Measures

Category	Metrics
Size	Total files, code/comment/blank lines, lines per file
Languages	Distribution by code lines and file count (40+ languages)
Complexity	Per-function cyclomatic complexity estimate, top complex functions
Quality	Code-to-comment ratio, test file coverage indicator
Dependencies	npm, pip, Go modules, Cargo crate counts
Tech Debt	TODO/FIXME/HACK/XXX counts across codebase
Files	Top 10 largest files by line count

Supported Languages

Python, JavaScript, TypeScript, Java, Go, Rust, Ruby, PHP, C, C++, C#, Swift, Kotlin, Scala, R, Lua, Perl, Shell, SQL, HTML, CSS, SCSS, Vue, Svelte, Dart, Elixir, Erlang, Zig, Nim, V, Solidity, Terraform, Protobuf, and more.

Exit Codes

• 0 — Success
• 1 — Error (directory not found, language not found)