learn-codebase

Scan agent config files and surface security concerns in codebases.

Updated Mar 6, 2026
One-click install
npx skills add https://github.com/v36372/pi-stuff --skill learn-codebase-v36372
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: learn-codebase
Source: https://github.com/v36372/pi-stuff/tree/main/skills/learn-codebase
Command: npx skills add https://github.com/v36372/pi-stuff --skill learn-codebase-v36372

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Quickly understand project conventions and surface potential security concerns when joining a new or unfamiliar codebase, helping you onboard faster and reduce risk.

Core Features & Use Cases

  • Convention discovery: Scan the project root for agent instruction files (CLAUDE.md, AGENTS.md, .cursorrules, .clinerules) and agent config directories (.claude, .cursor, .github, .pi) to surface enforced rules and patterns.
  • Conventions summary: Read and summarize root rules, deeper guideline files, and CLI/skill scripts to produce a concise view of project conventions and guardrails.
  • Skills integration: Identify available skills in skill directories and optionally register discovered skills in .pi/settings.json for later reuse.
  • Top conventions: Highlight the most critical conventions to follow to stay compliant with project norms.
  • Security & smell sweep: Provide an initial scan for potential security smells, such as hardcoded secrets or risky configurations, with actionable guidance.

Quick Start

Run the learn-codebase skill to scan the repository for agent instruction files and surface conventions and security concerns.

Frequently Asked Questions about learn-codebase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan an unfamiliar codebase for security risks and project conventions?

To scan an unfamiliar codebase for security risks and conventions, run the learn-codebase skill to identify enforced rules in agent config files and sweep for hardcoded secrets, insecure patterns, and suspicious dependencies.

What is the best way to discover coding conventions in a new repository?

Discovering coding conventions in a new repository involves scanning root instruction files like CLAUDE.md and .cursorrules. This skill reads those files to summarize enforced rules, deeper guidelines, and critical project guardrails.

How do I find hardcoded secrets and insecure patterns during project onboarding?

Finding hardcoded secrets and insecure patterns during project onboarding requires a security smell sweep. This skill scans configurations and dependencies to surface risky patterns and provides actionable security guidance.

Can I automatically register discovered agent skills in my project settings?

You can automatically register discovered agent skills in project settings. This skill identifies available skills in skill directories and optionally registers them directly into the .pi/settings.json file for later reuse.

Does this codebase scanning tool work with agent config files like .claude and .cursor?

This codebase scanning tool works directly with agent config files like .claude and .cursor. It scans these directories alongside instruction files to surface enforced rules and project conventions.

What are the limitations of automated security smell sweeps for codebase onboarding?

Automated security smell sweeps for codebase onboarding provide an initial scan for potential risks like hardcoded secrets, but serve as a preliminary check rather than a comprehensive security audit of all suspicious dependencies.