repo-audit — Claude Code skill: what it does, how to install
Analyzes Git history to reveal frequently modified hotspot files, author ownership metrics, and leaked credentials across all commits.
npx skills add zebbern/claude-code-guide --skill repo-audit -a claude-codeWhat repo-audit does
The skill investigates Git repositories using three dedicated shell scripts. The scripts/hotfiles.sh script pinpoints heavily edited files, displaying the top 20 churn hotspots by default. This highlights fragile code sections and candidates for refactoring.
Ownership analysis runs via scripts/ownership.sh. It reports commit shares, added or removed lines, and last active dates per contributor for the entire project or a selected directory. To catch security risks, scripts/secret-scan.sh inspects commit history, including deleted revisions, looking for AWS keys, Slack tokens, SSH private keys, and passwords.
The toolkit relies on git 2.20 or newer, bash 4.0 or newer, and core Unix tools like awk, grep, sort, and head. It requires no third-party APIs. Without bash 4.0 in your environment, the scripts will fail to execute.
What it helps with
- detect frequently edited files that create technical debt
- identify primary code owners before assigning review tasks
- scan commit history across all branches for leaked tokens and private keys
- export Git contributor activity metrics to table, CSV, or JSON
Example prompts for the agent
- Scan the Git history for leaked credentials and private keys
- Show the top 20 most frequently changed files since 2024-01-01
- Check code ownership and recent contributors for the
src/apifolder
How to install repo-audit
1Skills CLI (Vercel)
npx skills add zebbern/claude-code-guide --skill repo-audit -a claude-code2Manually: put the files in place
~/.claude/skills/repo-audit/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/repo-audit/
1Skills CLI (Vercel)
npx skills add zebbern/claude-code-guide --skill repo-audit -a codex2Manually: put the files in place
.agents/skills/repo-audit/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add zebbern/claude-code-guide --skill repo-audit -a cursor2Manually: put the files in place
.cursor/skills/repo-audit/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install zebbern/claude-code-guide repo-audit2Manually: put the files in place
.github/skills/repo-audit/SKILL.md1Skills CLI (Vercel)
npx skills add zebbern/claude-code-guide --skill repo-audit -a gemini-cli2Platform CLI
gemini skills install https://github.com/zebbern/claude-code-guide --path skills/repo-auditManually: put the files in place
.devin/skills/repo-audit/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add zebbern/claude-code-guide --skill repo-audit -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about repo-audit
How do I install repo-audit in Claude Code?
Run npx skills add zebbern/claude-code-guide --skill repo-audit -a claude-code. You can also place the configuration file manually at ~/.claude/skills/repo-audit/SKILL.md.
What does repo-audit do?
It runs a three-part analysis on Git history: detecting hotspot files, calculating author contributions by lines and commits, and scanning revisions for exposed API keys and passwords.
What are the system requirements for repo-audit?
It requires git (>= 2.20), bash (>= 4.0), and standard Unix utilities such as awk, sort, head, and grep. No paid APIs or extra packages are needed.
Source text
SKILL.md · MIT
--- name: repo-audit description: "Deep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets. Triggered when users ask about Git analysis, code hotspots, who owns what code, secret scanning, security audits of commit history, or optimizing code review assignments." type: tool license: MIT tags: - git - security - analysis - devops --- # Repo Audit — Deep Analysis of Git History Perform three-dimensional analysis on a Git repository: **hotspot file detection**, **code ownership analysis**, and **secret leak scanning**. ## Feature Overview ### 1. Hotspot File Analysis (`scripts/hotfiles.sh`) Identify the most frequently changed files in a repository to help spot: - High-risk code areas (frequent changes = potential instability) - Files that deserve extra attention during code review - Modules that may need splitting or refactoring **Usage:** ```bash bash scripts/hotfiles.sh [options] ``` | Option | Description | Default | |--------|-------------|---------| | `--repo PATH` | Repository path | Current directory | | `--top N` | Show top N files | 20 | | `--since DATE` | Start date (e.g. `2024-01-01`) | None | | `--until DATE` | End date | None | | `--author AUTHOR` | Filter by author | None | | `--format FORMAT` | Output format: `table` / `csv` / `json` | table | ### 2. Code Ownership Analysis (`scripts/ownership.sh`) Analyze actual code ownership, reporting for each contributor within the specified scope: - Commit count and percentage - Lines changed (additions/deletions) - Last active date **Usage:** ```bash bash scripts/ownership.sh [options] ``` | Option | Description | Default | |--------|-------------|---------| | `--repo PATH` | Repository path | Current directory | | `--path SUBPATH` | Analyze a specific subdirectory or file | Entire repo | | `--top N` | Show top N contributors | 10 | | `--since DATE` | Start date | None | | `--format FORMAT` | Output format: `table` / `csv` / `json` | table | ### 3. Secret Leak Scanning (`scripts/secret-scan.sh`) Scan the full Git history (including deleted commits) for common secrets and sensitive information: - AWS Access Key / Secret Key - GitHub / GitLab / Slack Tokens - SSH Private Keys - Generic API Keys, passwords, and secret patterns **Usage:** ```bash bash scripts/secret-scan.sh [options] ``` | Option | Description | Default | |--------|-------------|---------| | `--repo PATH` | Repository path | Current directory | | `--branch BRANCH` | Scan a specific branch | All branches | | `--since DATE` | Start date | None | | `--format FORMAT` | Output format: `table` / `csv` / `json` | table | | `--severity LEVEL` | Minimum severity level: `low` / `medium` / `high` | low | ## Use Cases - **Security audits**: Scan history for leaked secrets before deploying to production - **Code review optimization**: Identify hotspot files and prioritize reviewing high-risk areas - **Team collaboration**: Understand who knows which parts of the code best, and assign reviews accordingly - **Tech debt assessment**: Frequently changed files are strong candidates for refactoring ## Dependencies - `git` (>= 2.20) - `bash` (>= 4.0) - Standard Unix utilities: `awk`, `sort`, `head`, `grep` No additional dependencies or paid APIs required.
© zebbern · MIT · zebbern/claude-code-guide
