Nm Gauntlet Extract

Analyze a codebase and build a knowledge base of business logic, architecture, data flow, and engineering patterns. The foundation for gauntlet challenges an...

Security Scan

The skill's purpose (extracting codebase knowledge) is believable, but the runtime instructions reference an undeclared environment variable and an undeclared runtime (python3), which is an inconsistency you should verify before use.

Purpose & Capability

The name/description match the instructions: the skill is an instruction-only extractor that analyzes a codebase and writes .gauntlet/knowledge.json. That capability aligns with its stated purpose.

Instruction Scope

Instructions require running: python3 ${CLAUDE_PLUGIN_ROOT}/scripts/extractor.py <target-dir> and read/write .gauntlet/knowledge.json and .gauntlet/annotations/. The use of CLAUDE_PLUGIN_ROOT is not declared anywhere and grants the agent a file-system path it will use; the instructions also default to the current working directory (which may permit reading arbitrary repo files). These are functional for the stated goal but the undeclared env var and broad filesystem access are concerning and should be validated.

Install Mechanism

There is no install spec and no code files included (instruction-only). That minimizes install-time risk because nothing is downloaded or written by an installer.

Credentials

The skill declares no required env vars, yet the runtime instructions reference CLAUDE_PLUGIN_ROOT (an environment variable) and implicitly require python3. The mismatch (undeclared CLAUDE_PLUGIN_ROOT and an undeclared required binary) is disproportionate and could lead to unexpected path usage or failures.

Persistence & Privilege

always is false and the skill is user-invocable. It does not request persistent platform privileges or to modify other skills. Its write scope is local (.gauntlet/knowledge.json), which is expected for its purpose.

What to consider before installing

This skill is instruction-only and appears to do what it says (scan a repo and build .gauntlet/knowledge.json), but check two things before installing or running it: (1) ensure CLAUDE_PLUGIN_ROOT is set to a safe path you control (the SKILL.md references ${CLAUDE_PLUGIN_ROOT}/scripts/extractor.py but the skill did not declare that env var), and (2) ensure python3 and the extractor script actually exist and are trustworthy. Because the instructions operate on the current working directory, run it on a copy or in an isolated environment if you have sensitive files in the repo. If possible, open and review scripts/extractor.py in the referenced plugin repo to confirm what it reads/transmits before giving it access to your codebase.

Night Market Skill — ported from claude-night-market/gauntlet. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Extract Codebase Knowledge

Build or rebuild the .gauntlet/knowledge.json knowledge base.

Steps

1. Identify target directory: use the current working directory or a user-specified path

2. Run AST extraction: invoke the extractor script

   python3 ${CLAUDE_PLUGIN_ROOT}/scripts/extractor.py <target-dir>
   

3. AI enrichment: for each extracted entry, enhance the detail field with natural language explanation of business logic, data flow, architectural role, and rationale

4. Cross-reference: link related entries across modules by matching imports, shared types, and data flow paths

5. Merge with annotations: preserve existing curated entries in .gauntlet/annotations/

6. Save: write to .gauntlet/knowledge.json

7. Report: show summary by category, coverage gaps, difficulty distribution

Category Priority

1. business_logic (weight 7)
2. architecture (weight 6)
3. data_flow (weight 5)
4. api_contract (weight 4)
5. pattern (weight 3)
6. dependency (weight 2)
7. error_handling (weight 1)