affaan-m/ECC

repo-scan

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.

91CollectingRuns scriptsNetwork accessReads files

See how to use it View GitHub source

npx skills add https://github.com/affaan-m/ECC --skill "skills/repo-scan"

Quick start

Start using it in three steps

Install it or open the source, trigger it with a clear task, then follow the source workflow.

Install the Skill

npx skills add https://github.com/affaan-m/ECC --skill "skills/repo-scan"

Describe the task

Use repo-scan to help me with: [describe your task]. Before you begin, tell me what input you need, the steps you will follow, and the expected output.

Follow the workflow

5 key workflow steps, examples, and cautions are distilled below.

Continue to the workflow

Direct answers

Answers to review before you install

What is repo-scan?

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.

Who should use repo-scan?

It is relevant to workflows involving Engineering, Research.

How do you install repo-scan?

SkillSignal detected this source-specific command: npx skills add https://github.com/affaan-m/ECC --skill "skills/repo-scan". Inspect the repository and command before running it.

Which Agent platforms does it support?

The upstream source does not declare a dedicated Agent platform.

What permissions or risks should you review?

Static analysis detected exec-script, network, read-files signals. Review the cited source lines before installing; these signals are not a security audit.

What are the current evidence limits?

This page combines upstream documentation with deterministic repository, quality, and static-risk signals. It is not described as a manual test or security review.

SkillSignal brief

Decide whether it fits your work first

Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports.

Useful in these contexts

Not yet included in a workflow collection

Core capabilities

EngineeringResearch

Before you use it

Platforms

No dedicated Agent platform is declared

Static risk signals

Runs scriptsNetwork accessReads files

mediumL17

git init repo-scan

The documentation asks the agent to run terminal commands or scripts.

mediumL19

git remote add origin https://github.com/haibindev/repo-scan.git

The documentation includes network, browsing, or remote request actions.

mediumL19

git remote add origin https://github.com/haibindev/repo-scan.git

The documentation asks the agent to run terminal commands or scripts.

lowL50

**Detect embedded libraries**: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.

The documentation asks the agent to read local files, directories, or repositories.

Getting started

npx skills add https://github.com/affaan-m/ECC --skill "skills/repo-scan"

This brief uses structured fields and static rules for quick evaluation; it is not a manual test result.

Distilled from the source

Understand this Skill in one minute

About 2 min · 9 sections

When it is worth using

•
Taking over a large legacy codebase and need a structural overview
•
Before major refactoring — identify what's core, what's duplicate, what's dead
•
Auditing third-party dependencies embedded directly in source (not declared in package managers)
•
Preparing architecture decision records for monorepo reorganization

Core workflow

1
Classify the repo surface: enumerate files, then tag each as project code, embedded third-party code, or build artifact.
2
Detect embedded libraries: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.
3
Score each module: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
4
Highlight structural risks: call out dead-weight artifacts, duplicated wrappers, outdated vendored code, and modules that should be extracted, rebuilt, or deprecated.
5
Produce the report: return a concise summary plus the interactive HTML output with per-module drill-down so the audit can be reviewed asynchronously.

Examples and typical usage

•
Found FFmpeg 2.x (2015 vintage) still in production
•
Discovered the same SDK wrapper duplicated 3 times
•
Identified 636 MB of committed Debug/ipch/obj build artifacts

Repository stars

234,327

Repository forks

35,711

Quality

91/100

Source repository last pushed

2026-07-27

Quality breakdown

Based on traceable docs and repository signals; stars are not treated as quality.

91/100

Documentation24/30

Specificity25/25

Maintenance20/20

Trust signals22/25

Compare before choosing

Related Agent Skills and source variants

These links are selected from shared tasks, functions, stacks, platforms, and same-name variants. Compare the source owner, documentation, permissions, and maintenance signals.

repo-scan by affaan-m

クロススタックのソースコード資産監査——各ファイルを分類し、埋め込まれたサードパーティライブラリを検出し、各モジュールに対してインタラクティブなHTMLレポートとともに実用的な4段階の判定を提供する。

repo-scan by affaan-m

跨栈源代码资产审计——对每个文件进行分类，检测嵌入的第三方库，并为每个模块提供可操作的四级判定结果，附带交互式HTML报告。

When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "should I test this," "which version is better," "test two versions," "statistical significance," "how long should I run this test," "growth experiments," "experiment velocity," "experiment backlog," "ICE score," "experimentation program

design-review by event4u-app

Use when the user says "review the design", "check the UI", or wants a comprehensive UI/UX review. Uses a 7-phase methodology covering interaction, responsiveness, accessibility, and more.

dask by k-dense-ai

Distributed computing for larger-than-RAM pandas/NumPy workflows. Use when you need to scale existing pandas/NumPy code beyond memory or across clusters. Best for parallel file processing, distributed ML, integration with existing pandas code. For out-of-core analytics on single machine use vaex; for in-memory speed use polars.

View original Skill.mdThis page is parsed directly from the repository SKILL.md without editorial rewriting. Collected: Jul 28, 2026 · about 2 min

repo-scan

Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.

When to Use

Taking over a large legacy codebase and need a structural overview
Before major refactoring — identify what's core, what's duplicate, what's dead
Auditing third-party dependencies embedded directly in source (not declared in package managers)
Preparing architecture decision records for monorepo reorganization

Installation

# Fetch only the pinned commit for reproducibility
mkdir -p ~/.claude/skills/repo-scan
git init repo-scan
cd repo-scan
git remote add origin https://github.com/haibindev/repo-scan.git
git fetch --depth 1 origin 2742664
git checkout --detach FETCH_HEAD
cp -r . ~/.claude/skills/repo-scan

Review the source before installing any agent skill.

Core Capabilities

Capability	Description
Cross-stack scanning	C/C++, Java/Android, iOS (OC/Swift), Web (TS/JS/Vue) in one pass
File classification	Every file tagged as project code, third-party, or build artifact
Library detection	50+ known libraries (FFmpeg, Boost, OpenSSL…) with version extraction
Four-level verdicts	Core Asset / Extract & Merge / Rebuild / Deprecate
HTML reports	Interactive dark-theme pages with drill-down navigation
Monorepo support	Hierarchical scanning with summary + sub-project reports

Analysis Depth Levels

Level	Files Read	Use Case
`fast`	1-2 per module	Quick inventory of huge directories
`standard`	2-5 per module	Default audit with full dependency + architecture checks
`deep`	5-10 per module	Adds thread safety, memory management, API consistency
`full`	All files	Pre-merge comprehensive review

How It Works

Classify the repo surface: enumerate files, then tag each as project code, embedded third-party code, or build artifact.
Detect embedded libraries: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.
Score each module: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
Highlight structural risks: call out dead-weight artifacts, duplicated wrappers, outdated vendored code, and modules that should be extracted, rebuilt, or deprecated.
Produce the report: return a concise summary plus the interactive HTML output with per-module drill-down so the audit can be reviewed asynchronously.

Examples

On a 50,000-file C++ monorepo:

Found FFmpeg 2.x (2015 vintage) still in production
Discovered the same SDK wrapper duplicated 3 times
Identified 636 MB of committed Debug/ipch/obj build artifacts
Classified: 3 MB project code vs 596 MB third-party

Best Practices

Start with standard depth for first-time audits
Use fast for monorepos with 100+ modules to get a quick inventory
Run deep incrementally on modules flagged for refactoring
Review the cross-module analysis for duplicate detection across sub-projects

repo-scan

Start using it in three steps

Install the Skill

Describe the task

Follow the workflow

Answers to review before you install

What is repo-scan?

Who should use repo-scan?

How do you install repo-scan?

Which Agent platforms does it support?

What permissions or risks should you review?

What are the current evidence limits?

Decide whether it fits your work first

Understand this Skill in one minute

When it is worth using

Core workflow

Examples and typical usage

Related Agent Skills and source variants

repo-scan by affaan-m

repo-scan by affaan-m

ab-testing by coreyhaines31

design-review by event4u-app

dask by k-dense-ai

repo-scan

When to Use

Installation

Core Capabilities

Analysis Depth Levels

How It Works

Examples

Best Practices

Links