repo-xray

repo-xray is a skill for Claude Code from jx-hxxx/hi-vibe. It costs 165 tokens per session (3,147 once invoked), scanned A, original, MIT.

A repository scanner for Python and JavaScript or TypeScript projects that reports evidence about files, structure, and code patterns.

In plain words
What is it for?
Use it to scan a repository, search for an exact or similarly named item, and review evidence-based cleanup suggestions.
Why use it?
It reduces guesswork when checking for duplicate, unused, missing, or already-existing code.

Skill for Claude Code

Written for Claude Code: user-invocable in frontmatter.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the hi-vibe plugin — 6 skills, 10 commands, 2 agents, 5 hooks shipped together

Good fit Use it to scan a repository, search for an exact or similarly named item, and review evidence-based cleanup suggestions.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add jx-hxxx/hi-vibe
Claude Code
/plugin install hi-vibe

Made for: Claude Code.

Or install hi-vibe, the plugin that ships this one along with the rest of its 6 skills, 10 commands, 2 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for repo-xray

README.md
[![agentmods](https://agentmods.dev/badge/skills/jx-hxxx/hi-vibe/repo-xray/github.svg)](https://agentmods.dev/skills/jx-hxxx/hi-vibe/repo-xray)
Your own site
<a href="https://agentmods.dev/skills/jx-hxxx/hi-vibe/repo-xray"><img src="https://agentmods.dev/badge/skills/jx-hxxx/hi-vibe/repo-xray/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for repo-xray

Your own site · 80×15
<a href="https://agentmods.dev/skills/jx-hxxx/hi-vibe/repo-xray"><img src="https://agentmods.dev/badge/skills/jx-hxxx/hi-vibe/repo-xray.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 165 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,147 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00165 $0.03147
Opus 5 $0.00082 $0.01573
Sonnet 5 $0.00033 $0.00629
Haiku 4.5 $0.00016 $0.00315

Measured 12d ago against content hash 0b896838615d, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

repo-xray scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/audit.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/repo-xray/SKILL.md · 211 lines

How it starts

The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.

repo-xray

A repo evidence engine: a script produces machine evidence, and you turn that evidence into short, kind, actionable advice. The reader may be new to coding — plain words, no tool jargon, at most three suggestions at a time unless they ask for a full report.

NO STRUCTURAL CLAIM WITHOUT RUNNING THE SCRIPT
NO ABSENCE CLAIM WITHOUT STATING THE SCAN RANGE
A DEAD "CANDIDATE" IS NOT A VERDICT

If you have not run the script in this session, do not state counts ("unused functions: 12") or absence ("that function doesn't exist"). Run it first, read the JSON, then make the smallest true claim the evidence supports. Cross this line and the tool becomes a confident guesser — exactly the failure it exists to prevent.

Commands

Run from anywhere; point --root at the repo being analyzed.

# Full structure scan -> writes <root>/.repo-xray/report.json
python3 <skill-path>/scripts/audit.py scan --root <repo>

# "Does X exist anywhere?" -> exact hits + similar names, prints JSON
python3 <skill-path>/scripts/audit.py find <name> --root <repo>

<skill-path> is this skill's directory — in plugin installs that is ${CLAUDE_PLUGIN_ROOT}/skills/repo-xray. The scan needs only Python 3 (stdlib) — no installs. Suggest adding .repo-xray/ to .gitignore once, the first time a scan runs in a repo.

실행 시간 — 느린 것 ≠ 멈춘 것

스캔은 저장소 크기에 따라 수 초에서 수십 초가 걸린다(함수가 많으면 near-duplicate 비교가 가장 오래 걸린다). 이건 정상이다. 짧은 타임아웃으로 끊고 다시 돌리지 마라 — 죽은 줄 알고 재실행하면 프로세스만 겹쳐 쌓여 머신이 포화되고 오히려 더 느려진다(관측된 실패 모드다). 오래 걸릴 것 같으면 한 번만 백그라운드로 돌리고 완료를 기다린 뒤 report.json을 읽어라. 스캔은 끝나면 항상 리포트를 쓰므로, 리포트가 없으면 "아직 도는 중"이지 "고장"이 아니다. near_duplicate_scan_truncated: true가 보이면 near-dup만 시간 상한에 걸려 일부 생략된 것이고, 나머지 결과는 완전하다.

Which command for which question

  • "중복 코드 있어?", "정리할 것 알려줘", "구조 어때?", "안 쓰는 코드?" → scan, then read report.json.
  • "X라는 함수/기능 이미 있어?", "어디서 쓰여?" → find X. If the user describes a behavior rather than a name ("환율 바꾸는 거"), run find on 2-3 plausible names (e.g. exchange, usd_to_krw, convertRate) and also check similar_symbol_names in the output.
  • Before writing a new helper the repo might already have → find first.

Read the full file on GitHub · 211 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 211 lines · 165 tokens per session scan A 0b896838615d

Subscribe to this mod's changes

repo-xray is a skill published in the GitHub repository jx-hxxx/hi-vibe (3 stars, last pushed today), licensed MIT. It adds 165 tokens to every session and 3,147 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

procoder

Work like a senior developer in a repository governed by procoder: run the commit gate before calling anything done, format and lint through the binary, and drive the spec, plan, todo, backlog, and sprint chain in .procoder/. Use this skill when the repository contains a .procoder/ directory or an AGENTS.md naming…

azrtydxb/procoder · 101 tokens

code-review

The depth half of a review - the dimensions a diff is read against (correctness, boundaries, concurrency, failure paths, secrets, data access, structure, test quality) and the rule that a finding is refuted before it is reported. The verdict stays with the reviewer agent. Use when reviewing a diff or a pull request…

jjanczur/tyran · 80 tokens

fidelity-gate

Build a UI against a frozen visual reference without drift - an inventory extracted before any code, a relics list, and a gate that MEASURES computed styles on a fixture carrying the reference's own data. Use when a mockup, design spec or screenshot is the contract.

jjanczur/tyran · 56 tokens

deslop

The optimization pass, defined - delete before you add, one smell class per pass, behaviour pinned by a test that ran BEFORE the edit. Lints a SKILL.md and prose by the same instinct. Use for the per-story optimization pass or when code has grown noisy without growing capable.

jjanczur/tyran · 58 tokens

prompt-tuning

Tune a prompt, or anything whose quality is measured by non-deterministic model output, without chasing noise - a noise baseline before the first edit, medians over repeated runs, enforcement AFTER generation rather than in the wording. Use when iterating on prompts or model-judged output.

jjanczur/tyran · 58 tokens

root-cause

Find the mechanism behind a failure instead of patching its symptom - reproduce first, one variable per experiment with the prediction written before the run, exit by naming the mechanism and pinning it with a failing test. Use for a bug, an unexplained red test, or a failure that will not reproduce.

jjanczur/tyran · 61 tokens