analyze

Produces read-only, evidence-backed codebase analysis with ranked feature-sized candidates.

1|Updated Apr 15, 2026
One-click install
npx skills add https://github.com/pnewsam/skills --skill analyze-pnewsam
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: analyze
Source: https://github.com/pnewsam/skills/tree/main/archive/analysis-validation-evicted/analyze
Command: npx skills add https://github.com/pnewsam/skills --skill analyze-pnewsam

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams often know a codebase has security, design-system, or quality problems but lack a measured, prioritized view of what is actually worth fixing. This Skill turns scanner output, metrics, and code signals into a small ranked set of actionable candidates without touching any code. ## Core Features & Use Cases - Dimension-agnostic measurement: Analyzes security posture, dependency advisories, design-system drift, code quality hotspots, test health, or any other named dimension using the same disciplined method. - Evidence-backed ranking: Every candidate carries verifiable evidence (commands, scanner output, churn and complexity metrics) and is ranked by impact versus effort. - Read-only guarantee: Never edits code, dependencies, plans, Git state, or external systems, making it safe to run before any planning step. - Use Case: Point it at a repository after a Dependabot alert wave to verify which advisories are reachable, group them into bounded candidates, and hand a ranked list to a planning step. ## Quick Start Use the analyze skill to audit this repository's security posture and produce a ranked list of feature-sized candidates with supporting evidence.

Frequently Asked Questions about analyze

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a codebase for security issues before planning fixes?▼

Run a read-only analysis that gathers dependency advisories, SAST findings, and exposure signals, then verifies each finding is real and reachable. The output is a ranked set of feature-sized candidates with cited evidence, ready for a planning step.

How to turn Dependabot or CodeQL findings into prioritized work?▼

Feed scanner output into an analysis pass that discards noise, confirms reachability, and groups findings into bounded candidates ranked by impact versus effort. Each candidate includes the measured evidence and rough size so planning can pick one up directly.

Can codebase analysis measure design-system drift and UI inconsistency?▼

Yes, design-system convergence is a supported dimension. The analysis scans token, primitive, and component-family usage to inventory pattern drift, duplication, and legacy components, then ranks migration candidates by leverage.

Does codebase analysis modify files or Git state?▼

No, the analysis is strictly read-only. It never edits code, dependencies, styles, or configuration, and never commits, pushes, or changes external systems, so it is safe to run at any point before planning.

When should I not use evidence-ranked codebase analysis?▼

Skip it when you need a formal threat model with assets, actors, and trust boundaries, or a current-state architecture document, since those are different output framings produced directly. It also does not provide legal or regulatory interpretation such as GDPR applicability.