analyze-agent-codebase

analyze-agent-codebase is a skill for Claude Code, Codex from murray17/rovai-ai. It costs 99 tokens per session (1,547 once invoked), scanned A, original, MIT.

A method for examining a coding-agent or multi-agent codebase by tracing its real execution path from entry point to tools, state, storage, and results. It relies on source code, configuration, schemas, migrations, and tests rather than assumptions from names.

In plain words
What is it for?
Mapping agent architecture, following a specific mechanism through the code, and documenting confirmed facts, inferences, evidence, and unknowns.
Why use it?
It helps explain how the system actually works when documentation is incomplete or misleading.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/murray17/rovai-ai/analyze-agent-codebase
Any agent
npx skills add murray17/rovai-ai --skill analyze-agent-codebase
Clone the repo
git clone --depth 1 https://github.com/murray17/rovai-ai

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for analyze-agent-codebase

README.md
[![agentmods](https://agentmods.dev/badge/skills/murray17/rovai-ai/analyze-agent-codebase.svg)](https://agentmods.dev/skills/murray17/rovai-ai/analyze-agent-codebase)
Your own site
<a href="https://agentmods.dev/skills/murray17/rovai-ai/analyze-agent-codebase"><img src="https://agentmods.dev/badge/skills/murray17/rovai-ai/analyze-agent-codebase.svg" alt="Measured on agentmods" height="20"></a>
Per session 99 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,547 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00099 $0.01547
Opus 5 $0.00049 $0.00773
Sonnet 5 $0.00020 $0.00309
Haiku 4.5 $0.00010 $0.00155

Measured 4d ago against content hash f4eb72dee133, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

analyze-agent-codebase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/analyze-agent-codebase/SKILL.md · 126 lines

How it starts

The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agent 代码库分析

从真实入口、调用链、状态变化和持久化边界还原系统如何运行。文档用于解释设计意图,但架构结论必须回到可执行代码和测试证据。

分析边界

  • 先遵守目标仓库的 AGENTS.mdCLAUDE.md、文档导航和只读规则。
  • 默认只读。只有用户明确要求创建或维护分析文档时才写文件,不顺手修改实现。
  • 以源码、依赖装配、配置、schema、migration 和测试为实现证据。
  • 每个重要结论标为 已确认推断未知;推断说明依据,未知不凭常见框架行为补齐。
  • 重要结论给出代码位置和相关 symbol;跨模块行为给出入口到副作用的调用链。
  • 不因名称中出现 agentmemoryplantoolmiddleware 就认定对应能力存在。
  • 使用用户要求的语言;未指定时沿用用户输入语言。

选择分析范围

根据用户目标选择最小充分范围:

  1. 定向机制问题:只追踪回答该问题所需的纵向切片。
  2. 代码库架构报告:覆盖用户指定的多个机制,并形成整体运行时图景。
  3. 专题文档集:用户明确要求沉淀多篇文档或完整分析时,读取 分析轴与专题文档

如果仓库已有同类分析,先检查其范围、依据和版本;更新正确归宿,不建立重复总览。

工作流

1. 固定范围

记录:

  • 仓库根目录和可用的 revision;
  • 用户关心的问题、排除项和交付形式;
  • 主要语言、构建入口和生成代码目录;
  • 开始时的工作区状态。

区分生产源码、测试、生成物、vendor、fixture、示例和历史文档,不把测试夹具或示例当作生产路径。

2. 建立运行时骨架

先从真实入口向内追踪:

入口
  → 配置与依赖装配
  → Agent 或工作流构造
  → 执行与调度循环
  → 模型、工具、协作和持久化副作用
  → 事件、恢复和展示

优先寻找 binary/package 入口、路由注册、factory、registry、核心状态类型和持久化边界。动态注册系统继续追到加载器、宏、装饰器或配置解析器,直到能够解释具体实现如何进入运行时。

3. 追踪纵向切片

为每个问题选择一个真实触发场景,沿调用链追到:

输入 → 权限与校验 → 状态转换 → 外部副作用 → 结果 → 错误与恢复

完整分析时,从 reference 中选择代码里真实存在的分析轴,不为了填满清单虚构子系统。

4. 建立证据表

边读边记录,不在最后凭印象补引用:

结论 状态 代码证据 测试或运行证据 限制或反证
<可证伪的完整句子> 已确认 / 推断 / 未知 <path:line + symbol 或调用链> <test / fixture / trace> <冲突、动态边界或缺口>

证据必须支持完整结论。例如认定“支持子 Agent”时,应说明谁创建、如何传递上下文、隔离边界在哪里,以及结果如何返回调用者。

5. 形成架构判断

从证据中说明:

  • 哪一层拥有控制权和状态真源;
  • 主要同步与异步流程如何连接;
  • 上下文、会话恢复、长期记忆和业务历史分别由谁负责;
  • Tool、Skill、prompt 和 permission 如何连接但保持职责分离;
  • 错误、重试、取消、幂等和恢复边界到哪里为止;
  • 文档主张与生产实现有哪些一致、漂移或尚未接通之处。

详细分类判据由 reference 负责。

6. 交叉验证

  • 用测试、fixture、schema 或可执行路径核对关键调用链。
  • 对关键 symbol 做反向引用,确认它进入生产装配而不是孤立实现。
  • 检查 feature flag、平台分支、adapter 和替代入口,避免把一个实现概括成全系统行为。
  • 测试只证明实际覆盖的行为;没有运行的验证明确标为 not_run
  • 用户没有禁止读取文档时,对照权威文档并记录代码—文档漂移。

7. 交付

先给结论和系统图景,再给证据与限制。通常包含:

  • 分析范围、revision 和排除项;
  • 运行时拓扑与关键端到端流程;
  • 用户点名机制的结论和证据状态;
  • 主要设计取舍、真实约束和代码—文档漂移;
  • 高价值未知项及继续验证方式;
  • 代码位置或专题文档阅读顺序。

不要大段复制源码或已有文档。引用最小必要片段,并以路径、symbol 和解释为主。

Read the full file on GitHub · 126 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 126 lines · 99 tokens per session scan A f4eb72dee133

Subscribe to this mod's changes

analyze-agent-codebase is a skill published in the GitHub repository murray17/rovai-ai (45 stars, last pushed today), licensed MIT. It adds 99 tokens to every session and 1,547 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

factory-render-verify

Render-and-measure receipts for any HTML page your factory builds — the render half of the design quality gate. Engineer runs it to screenshot every screen size and MEASURE what a source read or a single screenshot only guesses at: horizontal overflow, computed type sizes, tap-target sizes, safe-area presence, mono…

squidbay/factory · 133 tokens

debug-test-failure

Systematically diagnose a failing test instead of guessing at fixes.

ArdurAI/ardur-agent · 17 tokens

write-runbook

Turn an incident response into a reusable runbook the next on-call can follow.

ArdurAI/ardur-agent · 20 tokens

factory-security

The Team Leader seat's security read on a PR, run as part of its audit BEFORE the human merges. Explicit-invoke: run when a PR touches credentials, workflows, auth, payments, or personal data — or when the human asks 'is this safe to merge?'. Reads the change in full, reports only high-confidence, real problems in…

squidbay/factory · 139 tokens

factory-update

Explains and drives the factory's update path — how improvements to the public template reach this office as a human-gated pull request. Invoke when the human asks 'is my factory up to date?', when a factory-update PR needs explaining hunk by hunk, or when an update was declined and needs a selective re-apply.

squidbay/factory · 70 tokens

creative-director

Boot the Creative Director seat — the factory's design lane, read-only on code, one of the four seats (Coach, Team Leader, Engineer, Creative Director) — for the Claude Design canvas. Invoke only when the human explicitly types /creative-director or asks to boot the Creative Director. On the Design surface itself, the…

squidbay/factory · 101 tokens