learn-codebase

To scan an unfamiliar codebase for security risks and conventions, run the learn-codebase skill to identify enforced rules in agent config files and sweep for hardcoded secrets, insecure patterns, and suspicious dependencies.

Discovering coding conventions in a new repository involves scanning root instruction files like CLAUDE.md and .cursorrules. This skill reads those files to summarize enforced rules, deeper guidelines, and critical project guardrails.

Finding hardcoded secrets and insecure patterns during project onboarding requires a security smell sweep. This skill scans configurations and dependencies to surface risky patterns and provides actionable security guidance.

You can automatically register discovered agent skills in project settings. This skill identifies available skills in skill directories and optionally registers them directly into the .pi/settings.json file for later reuse.

This codebase scanning tool works directly with agent config files like .claude and .cursor. It scans these directories alongside instruction files to surface enforced rules and project conventions.

Automated security smell sweeps for codebase onboarding provide an initial scan for potential risks like hardcoded secrets, but serve as a preliminary check rather than a comprehensive security audit of all suspicious dependencies.