Skip to content

/repo-context

Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis.

From plugin
skills
4328 skills

Claude Code

$ npx -y skills add ghostsecurity/skills --skill repo-context --agent claude-code

SKILL.md

repo-context.SKILL.md
name: "ghost-repo-context"
description: "Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis."
allowed-tools: Read, Write, Edit, Glob, Grep, Bash
license: apache-2.0
metadata:
  version: 1.1.0

Repository Context Builder

You gather repository context by detecting projects, summarizing their architecture, and writing the results to `repo.md`. Do all work yourself — do not spawn subagents or delegate.

Inputs

Parse these from `$ARGUMENTS` (key=value pairs):

  • **repo_path**: path to the repository root
  • **cache_dir**: path to the cache directory (defaults to `~/.ghost/repos/<repo_id>/cache`)

$ARGUMENTS

If `cache_dir` is not provided, compute it:

repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null || pwd) && short_hash=$(printf '%s' "$remote_url" | git hash-object --stdin | cut -c1-8) && repo_id="${repo_name}-${short_hash}" && cache_dir="$HOME/.ghost/repos/${repo_id}/cache" && echo "cache_dir=$cache_dir"

Tool Restrictions

Do NOT use WebFetch or WebSearch. All work must use only local files in the repository.

Setup

Discover this skill's own directory so you can reference agent files:

skill_dir=$(find . -path '*/skills/repo-context/SKILL.md' 2>/dev/null | head -1 | xargs dirname)
echo "skill_dir=$skill_dir"

---

Check Cache First

Check if `<cache_dir>/repo.md` already exists. If it does, skip everything and return:

Repository context is at: <cache_dir>/repo.md

If it does not exist, run `mkdir -p <cache_dir>` and continue.

---

Workflow

1. **Detect Projects** — Read `<skill_dir>/detector.md` and follow its instructions against `<repo_path>`. Save the full detection output (project details needed for step 2). If detection finds no projects, write a minimal `repo.md` noting "No projects detected" and skip to step 4.

2. **Summarize Each Project** — Read `<skill_dir>/summarizer.md`. For EACH project detected in step 1, follow the summarizer instructions using that project's details (id, type, base_path, languages, frameworks, dependency_files, extensions, evidence). Collect the summary for each project. If summarization fails for a project, note it as "summary unavailable" and continue with remaining projects.

3. **Write repo.md** — Combine detection and summary results into `<cache_dir>/repo.md` using the format in `<skill_dir>/template-repo.md`. For each project include:

  • Detection: ID, Type, Base Path, Languages, Frameworks, Dependency Files, Extensions, Evidence
  • Summary: Architectural summary, Sensitive Data Types, Business Criticality, Component Map, Evidence

4. **Validate** — Read `<cache_dir>/repo.md` back and verify it contains the expected sections from `<skill_dir>/template-repo.md` (e.g., project entries with Detection and Summary fields). If the file is missing or malformed, retry the write once before reporting an error.

5. **Output** — Return: `Repository context is at: <cache_dir>/repo.md`

Read more
@ghostsecurity
Ships withskills

This repository is the Ghost Security plugin marketplace for Claude Code. It ships two plugins: Ghost Security AppSec Skills (ghost) and Ghost Security Exo (exo).

Stars on GitHub

Momentum

stars in total
432
Star history of ghostsecurity/skills on GitHub, a chart by star-history.com

Other skills on skills.

exo
Auto-invoked

exo

The single interface for building, improving, and debugging exo workflows. Routes to one of three intents. BUILD takes a rough…

proxy
Auto-invoked

proxy

Starts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers.…

report
Auto-invoked

report

Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a…

scan-code
Auto-invoked

scan-code

Ghost Security - SAST code scanner. Finds security vulnerabilities in source code by planning and executing targeted scans for…

scan-deps
Auto-invoked

scan-deps

Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies…

scan-secrets
Auto-invoked

scan-secrets

Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data.…

More skills from other plugins.

api-security

api-security

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…

@zhaoxuya520@zhaoxuya520Install Skill
nemoclaw-user-guide

nemoclaw-user-guide

Find official NemoClaw documentation for installation, configuration, operation, or troubleshooting. Also handles requested docs…

nemoclaw11d23k
@nvidia@nvidiaInstall Skill

Questions about repo-context.

Which coding agents can use repo-context?
repo-context installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.