repo-scan

Classify repository files and generate dependency and security hotspot reports.

60|14|Updated Apr 27, 2026
One-click install
npx skills add https://github.com/brucesongs/kali-claw --skill repo-scan-brucesongs
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: repo-scan
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/repo-scan
Command: npx skills add https://github.com/brucesongs/kali-claw --skill repo-scan-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-stack source code asset audit that classifies every file, detects embedded third-party libraries, and delivers actionable verdicts per module.

Core Features & Use Cases

  • Phase-driven analysis that yields Surface Classification, Dependency Detection, Security Hotspots, and Module Verdicts.
  • Dependency inventory across declared and vendored libraries, hotspot mapping, and per-module verdicts to guide security reviews and remediation.
  • Use cases include white-box penetration testing preparation, open-source security audits, supply-chain risk assessment, and CI/CD-ready governance across multi-language repos.

Quick Start

Run the repo-scan workflow on your codebase to generate a comprehensive audit report and prioritized remediation plan.

Frequently Asked Questions about repo-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a multi-language repository for security hotspots and embedded libraries?

A repository security audit classifies all files into project code, third-party, configuration, and artifacts, then detects vendored libraries and maps security hotspots to produce per-module verdicts for review.

What is the best way to detect vendored dependencies and external libraries in source code?

Dependency detection inventories both declared and vendored libraries by classifying all files, mapping external dependencies to support supply-chain risk assessment and white-box penetration testing.

How do I prepare for a white-box penetration test across a large codebase?

Prepare for white-box penetration testing by running a phase-driven code audit that yields surface classification, dependency detection, and hotspot mapping to deliver actionable per-module verdicts.

Can I integrate static application security testing results into CI/CD workflows?

Static application security testing produces a structured report with dependency inventories, hotspot maps, and remediation recommendations designed to integrate directly with CI/CD and security-review workflows.

Does cross-stack code audit work for supply-chain risk assessment in open-source projects?

Cross-stack code audit supports open-source supply-chain risk assessment by detecting embedded libraries, mapping security hotspots, and generating per-module remediation plans for governance.

What are the limitations of automated code audit for generating module verdicts?

Automated code audit limitations involve relying on file classification and hotspot mapping accuracy; it guides security reviews but requires manual verification of complex per-module remediation verdicts.