code-mapper-skill

To map Python import dependencies and reference cycles, this Skill uses grimp and jedi to generate deterministic JSON maps of transitive dependencies for static repository analysis. It identifies blast radius and cyclical imports without executing untrusted code.

CodeQL taint flow analysis for Python codebases optionally provides semantic enrichment by tracking local value and data movement through your application. It generates targeted evidence of how data flows, complementing the base dependency and contract maps.

The best way to extract API contracts from OpenAPI, GraphQL, and Protobuf files is using this Skill's contract and lineage mapping feature. It parses schemas and Backstage catalog relationships to generate deterministic artifact maps.

Yes, you must configure an explicit work root for Python static code analysis. The Skill adheres to strict read-only preflight policies for safety, requiring a local project root directory to generate dependency and contract maps.

Yes, you can use grimp and jedi for blast radius analysis without running untrusted code. This Skill performs static repository analysis to identify transitive dependencies and import cycles safely under strict read-only policies.

Limitations of static dependency mapping include requiring an explicit work root configuration and adhering to strict read-only preflight policies. CodeQL semantic enrichment is optional and focused on local value flow rather than full runtime analysis.