What is generate-snapshot?

A tool that creates a JSON snapshot of a codebase's health using its Git history, code complexity, debt markers, and dependencies. Technical debt means code problems that make future changes harder.

Planning refactoring, tracking technical debt, finding high-priority code hotspots, checking code before releases, and spotting knowledge-silo risks.

It helps identify files that change often, are complex, contain TODOs or FIXMEs, have dependency problems, or rely heavily on one author.

generate-snapshot — Skill for Claude Code by mahmoud20138

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add mahmoud20138/Tradecraft --skill generate-snapshot

Clone the repo

git clone --depth 1 https://github.com/mahmoud20138/Tradecraft

Made for: Claude Code.

Or install tradecraft, the plugin that ships this one along with the rest of its 58 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/mahmoud20138/tradecraft/generate-snapshot/github.svg)](https://agentmods.dev/skills/mahmoud20138/tradecraft/generate-snapshot)

Your own site

<a href="https://agentmods.dev/skills/mahmoud20138/tradecraft/generate-snapshot"><img src="https://agentmods.dev/badge/skills/mahmoud20138/tradecraft/generate-snapshot/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/mahmoud20138/tradecraft/generate-snapshot"><img src="https://agentmods.dev/badge/skills/mahmoud20138/tradecraft/generate-snapshot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 39 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,029 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00039	$0.01029
Opus 5	$0.00019	$0.00515
Sonnet 5	$0.00008	$0.00206
Haiku 4.5	$0.00004	$0.00103

Measured 11d ago against content hash cce0c4ad97e6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

generate-snapshot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/tradecraft/skills/generate-snapshot/SKILL.md · 149 lines

How it starts

The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Generate Codebase Snapshot

This skill generates a comprehensive code health snapshot using the analysis modules in analysis/.

When to Use

During planning phase to identify work items
To find refactoring hotspots (high churn + high complexity)
To track technical debt over time
Before major releases to assess code health
To identify knowledge silos (bus factor risks)

How to Generate

# From repository root
python -m analysis.snapshot --output analysis-snapshot.json

Add --pretty flag to also print the JSON to stdout.

Note: The snapshot is written to the repository root (analysis-snapshot.json). This path is ignored by .gitignore.

Snapshot Structure

The snapshot contains these sections:

`summary` - High-level metrics dashboard

files_with_changes: Number of files with git changes
total_churn: Total lines added + deleted
high_complexity_files: Count of files with high complexity
todo_count, fixme_count: Debt marker counts
circular_dependency_count: Architectural issues
single_author_file_ratio: Bus factor indicator

`priority_hotspots` - Top 20 refactoring candidates

Files sorted by priority_score = change_count × max_complexity

{
    "path": "src/features/terminal/terminalManager.ts",
    "change_count": 45,
    "churn": 1200,
    "max_complexity": 18,
    "priority_score": 810
}

High priority_score = frequently changed AND complex = prime refactoring target.

`git_analysis` - Change patterns

hotspots: Most frequently changed files
temporal_coupling: Files that change together (hidden dependencies)
bus_factor: Knowledge concentration risks

`complexity` - Code complexity metrics

by_language.typescript: TypeScript file metrics (max_complexity, avg_complexity, function_count)
high_complexity_functions: Functions with cyclomatic complexity > 10

`debt_indicators` - Technical debt markers

debt_markers.by_type: TODO, FIXME, HACK comments by type
large_files: Files exceeding 500 lines of code
long_functions: Functions exceeding 50 lines

Read the full file on GitHub · 149 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 149 lines · 39 tokens per session scan A cce0c4ad97e6

Subscribe to this mod's changes

generate-snapshot is a skill published in the GitHub repository mahmoud20138/Tradecraft (15 stars, last pushed 4mo ago), licensed MIT. It adds 39 tokens to every session and 1,029 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Analytics and metrics Planning ai ai-agents claude-skills dev generate platform/governance quality skills snapshot tradinganalysis tradingsignalmonitoring

offensive-crypto-attacks

Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block cut-and-paste and…

SnailSploit/Claude-Red · 261 tokens

offensive-parameter-pollution

HTTP parameter pollution (HPP) checklist: duplicate parameter injection, backend vs frontend parsing differences, WAF bypass via HPP, server-side vs client-side HPP, and practical exploitation patterns. Use when testing web applications for parameter handling flaws.

SnailSploit/Claude-Red · 0 tokens

offensive-wifi

Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons…

SnailSploit/Claude-Red · 183 tokens

offensive-z-wave

Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting…

SnailSploit/Claude-Red · 113 tokens

comptable

Comptabilité, fiscalité et facturation pour entreprises françaises. Gère écritures PCG, déclarations TVA, IS/IR, clôture annuelle, liasse fiscale (2033/2065), FEC, états financiers, et chaîne facturation (mentions obligatoires, numérotation, Factur-X/UBL/CII, plateformes agréées PDP/PA, e-reporting, réforme 2026…

romainsimon/paperasse · 143 tokens

fiscaliste

Fiscaliste IA pour la fiscalité personnelle des particuliers français : optimisation et déclaration de l'impôt sur le revenu, IFI, revenus du capital, revenus fonciers, equity salarial, crypto-actifs et PER. Couvre le calcul de l'IR (barème, quotient familial, décote, PAS, CEHR, revenus exceptionnels), la déclaration…

romainsimon/paperasse · 302 tokens