repo-scan

Classify repository files and generate dependency and security hotspot reports.

60|14|Updated Apr 27, 2026
One-click install
npx skills add https://github.com/brucesongs/kali-claw --skill repo-scan-brucesongs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: repo-scan
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/repo-scan
Command: npx skills add https://github.com/brucesongs/kali-claw --skill repo-scan-brucesongs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-stack source code asset audit that classifies every file, detects embedded third-party libraries, and delivers actionable verdicts per module.

Core Features & Use Cases

  • Phase-driven analysis that yields Surface Classification, Dependency Detection, Security Hotspots, and Module Verdicts.
  • Dependency inventory across declared and vendored libraries, hotspot mapping, and per-module verdicts to guide security reviews and remediation.
  • Use cases include white-box penetration testing preparation, open-source security audits, supply-chain risk assessment, and CI/CD-ready governance across multi-language repos.

Quick Start

Run the repo-scan workflow on your codebase to generate a comprehensive audit report and prioritized remediation plan.

Frequently Asked Questions about repo-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a multi-language repository for security hotspots and embedded libraries?▼

A repository security audit classifies all files into project code, third-party, configuration, and artifacts, then detects vendored libraries and maps security hotspots to produce per-module verdicts for review.

What is the best way to detect vendored dependencies and external libraries in source code?▼

Dependency detection inventories both declared and vendored libraries by classifying all files, mapping external dependencies to support supply-chain risk assessment and white-box penetration testing.

How do I prepare for a white-box penetration test across a large codebase?▼

Prepare for white-box penetration testing by running a phase-driven code audit that yields surface classification, dependency detection, and hotspot mapping to deliver actionable per-module verdicts.

Can I integrate static application security testing results into CI/CD workflows?▼

Static application security testing produces a structured report with dependency inventories, hotspot maps, and remediation recommendations designed to integrate directly with CI/CD and security-review workflows.

Does cross-stack code audit work for supply-chain risk assessment in open-source projects?▼

Cross-stack code audit supports open-source supply-chain risk assessment by detecting embedded libraries, mapping security hotspots, and generating per-module remediation plans for governance.

What are the limitations of automated code audit for generating module verdicts?▼

Automated code audit limitations involve relying on file classification and hotspot mapping accuracy; it guides security reviews but requires manual verification of complex per-module remediation verdicts.