repo-scan
affaan-m/ecc
Cross-stack source code audit: classify files, detect embedded libraries, assign refactoring verdicts.
What is repo-scan?
Scans C++, Java, iOS, and Web codebases in a single pass to classify every file as project code, third-party, or build artifact, detects 50+ embedded libraries with versions, and assigns four-level refactoring verdicts (Core Asset / Extract & Merge / Rebuild / Deprecate) per module. Use it when taking over legacy code, planning major refactoring, or auditing undeclared third-party dependencies.
- Scans C/C++, Java/Android, iOS (ObjC/Swift), and Web (TS/JS/Vue) codebases in one pass
- Classifies every file as project code, third-party, or build artifact
- Detects 50+ known embedded libraries (FFmpeg, Boost, OpenSSL, etc.) with version extraction
- Assigns four-level verdicts per module: Core Asset, Extract & Merge, Rebuild, or Deprecate
- Generates interactive HTML reports with drill-down navigation and dark theme
- Supports monorepo hierarchical scanning with summary and sub-project reports
How to install repo-scan
npx skills add null --skill repo-scan- Git installed to clone the repository
- Node.js and npm (for npx command)
How to use repo-scan
- 1.Clone the skill repository to ~/.claude/skills/repo-scan using the provided git commands
- 2.Run repo-scan on your target repository with a chosen depth level (fast, standard, deep, or full)
- 3.Review the generated interactive HTML report to see file classifications and module verdicts
- 4.Drill down into specific modules to inspect detected libraries and structural risks
- 5.Use the findings to prioritize refactoring, extraction, or deprecation decisions
Use cases
- Taking over a large legacy codebase to understand structural composition and ownership
- Before major refactoring to identify core code, duplicates, and dead weight
- Auditing third-party dependencies bundled directly in source rather than declared in package managers
- Preparing architecture decision records for monorepo reorganization or module extraction
- Discovering outdated vendored libraries and duplicated wrapper code across sub-projects
- Legacy codebase maintainers and architects
- Engineering leads planning refactoring or monorepo reorganization
- Security and compliance teams auditing undeclared dependencies
- Teams managing large multi-language codebases (C++, Java, iOS, Web)
repo-scan FAQ
fast reads 1-2 files per module for quick inventory; standard (default) reads 2-5 files with full dependency checks; deep reads 5-10 files adding thread safety and memory analysis; full reads all files for comprehensive pre-merge review.
Yes. It performs hierarchical scanning and produces both a summary report and individual sub-project reports for drill-down analysis.
C/C++, Java/Android, iOS (Objective-C and Swift), and Web (TypeScript, JavaScript, Vue).
It inspects directory names, header files, license files, and version markers to identify bundled dependencies and extract likely versions.
Core Asset (keep and maintain), Extract & Merge (pull into package manager), Rebuild (rewrite or replace), and Deprecate (remove or phase out).
Full instructions (SKILL.md)
Source of truth, from affaan-m/ecc.
name: repo-scan description: Cross-stack source code asset audit — classifies every file, detects embedded third-party libraries, and delivers actionable four-level verdicts per module with interactive HTML reports. metadata: origin: community
repo-scan
Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.
When to Use
- Taking over a large legacy codebase and need a structural overview
- Before major refactoring — identify what's core, what's duplicate, what's dead
- Auditing third-party dependencies embedded directly in source (not declared in package managers)
- Preparing architecture decision records for monorepo reorganization
Installation
# Fetch only the pinned commit for reproducibility
mkdir -p ~/.claude/skills/repo-scan
git init repo-scan
cd repo-scan
git remote add origin https://github.com/haibindev/repo-scan.git
git fetch --depth 1 origin 2742664
git checkout --detach FETCH_HEAD
cp -r . ~/.claude/skills/repo-scan
Review the source before installing any agent skill.
Core Capabilities
| Capability | Description |
|---|---|
| Cross-stack scanning | C/C++, Java/Android, iOS (OC/Swift), Web (TS/JS/Vue) in one pass |
| File classification | Every file tagged as project code, third-party, or build artifact |
| Library detection | 50+ known libraries (FFmpeg, Boost, OpenSSL…) with version extraction |
| Four-level verdicts | Core Asset / Extract & Merge / Rebuild / Deprecate |
| HTML reports | Interactive dark-theme pages with drill-down navigation |
| Monorepo support | Hierarchical scanning with summary + sub-project reports |
Analysis Depth Levels
| Level | Files Read | Use Case |
|---|---|---|
fast | 1-2 per module | Quick inventory of huge directories |
standard | 2-5 per module | Default audit with full dependency + architecture checks |
deep | 5-10 per module | Adds thread safety, memory management, API consistency |
full | All files | Pre-merge comprehensive review |
How It Works
- Classify the repo surface: enumerate files, then tag each as project code, embedded third-party code, or build artifact.
- Detect embedded libraries: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.
- Score each module: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
- Highlight structural risks: call out dead-weight artifacts, duplicated wrappers, outdated vendored code, and modules that should be extracted, rebuilt, or deprecated.
- Produce the report: return a concise summary plus the interactive HTML output with per-module drill-down so the audit can be reviewed asynchronously.
Examples
On a 50,000-file C++ monorepo:
- Found FFmpeg 2.x (2015 vintage) still in production
- Discovered the same SDK wrapper duplicated 3 times
- Identified 636 MB of committed Debug/ipch/obj build artifacts
- Classified: 3 MB project code vs 596 MB third-party
Best Practices
- Start with
standarddepth for first-time audits - Use
fastfor monorepos with 100+ modules to get a quick inventory - Run
deepincrementally on modules flagged for refactoring - Review the cross-module analysis for duplicate detection across sub-projects
Links
Related skills
More from affaan-m/ecc and the wider catalog.
research-ops
Evidence-first research workflow for current facts, comparisons, and recommendations.
returns-reverse-logistics
Expert returns operations framework for RMA, inspection, disposition, fraud detection, and refund processing.
rules-distill
Extract cross-cutting principles from installed skills and distill them into maintainable rules.
rust-patterns
Idiomatic Rust patterns for ownership, error handling, traits, and safe concurrency.
rust-testing
Comprehensive Rust testing patterns: unit, integration, async, property-based tests, mocking, and TDD workflow.
safety-guard
Prevent destructive operations on production systems and autonomous agents with configurable safety modes.