skills

agent
Security Audit
Fail
Health Warn
  • License — License: Apache-2.0
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 7 GitHub stars
Code Fail
  • exec() — Shell command execution in skills/codebase-recon/scripts/build-typed-cpg.sh
  • rm -rf — Recursive force deletion command in skills/codebase-recon/scripts/merge-jsp.sh
  • exec() — Shell command execution in skills/codebase-recon/scripts/new-query-workspace.sh
Permissions Pass
  • Permissions — No dangerous permissions requested

No AI report is available for this listing yet.

SUMMARY

Modernizr: agent skills for investigating legacy software with code property graphs, graph algorithms, and symbolic analysis.

README.md

ani-skills

A Claude Code plugin marketplace. One plugin covers one domain, and each plugin carries its own skills.

modernizr

modernizr — map, split, prove

An agent reads files. Some questions are not in any file.

  • Is this method genuinely unused?
  • Which modules are really coupled?
  • Where can this system split?
  • Can this business rule ever fire?

Those answers live between files, or in the XML, SQL and templates that are not code at all.

So: build a code property graph once, then point 1970s tooling at it.

  • Graph algorithms → where the domains divide, so you plan around a real boundary.
  • Formal proof and computer algebra → when two rules are the same rule, when a threshold is already implied, what the merged form is.

The agent decides what to ask and what the answer means.

Some of it is deliberately unorthodox:

  • Compile the JSP pages → the presentation layer becomes ordinary methods in the graph.
  • Read a framework's bytecode → what its config attributes do.
  • Replay the migrations → a schema that no file holds.

The move is always the same: find something that already knows the answer, and get it into the graph.

Three skills, by the shape of the answer you need

Skill You need The answer looks like
codebase-recon to locate or enumerate — what does this do, what calls it, what is dead, what does the config actually wire a list of methods, files and lines
code-graph to split or isolate — where the domains actually divide, how small the interface between them is, what you can plan around a boundary you can isolate one side of
code-symbolic to prove and simplify — are these two rules the same rule, is this threshold already implied, can these be merged a proof, and the merged form

Start with codebase-recon. It:

  • builds a code property graph worth trusting
  • joins that graph to the XML, SQL, properties and templates the graph cannot see
  • tells you, as often as not, that a CPG is the wrong tool and ripgrep already answers your question

The other two skills read its exports.

The plugin also ships hooks. They:

  • block a curl to the Joern server, which silently answers about a different codebase
  • advise on several trap-shaped queries

scale-engineering

When the same shape repeats N times, do not scope it N times.

Pages, forms, rules, endpoints, reports, migration targets. Scoped one per ticket, each engineer pays a strong model to think the same thoughts again, and AI cost tracks headcount.

scale-engineering moves the unit of work to the class:

  • Find the families → group instances by how they vary; a human confirms each family, and the leftovers are the long tail.
  • Split slot from slottable entity → build the shared part once, keep only what varies as configuration.
  • Verify first → differential tests for a migration, per-family specs for new work.
  • Write the generator → AI writes the codemod, deterministic tools run it.
  • Fix the generator, never one output → rerun on every instance.

It also sizes the work (foundation + generator + cost per instance × N + long tail, then the break-even N) and says when to skip the approach: small N, parity work nobody needs, weak verification, unconfirmed families.

It is pure method and needs nothing installed. On a legacy codebase, modernizr can find the families for it.

Coming next (modernizr)

Not built yet. Both read the same graph and exports, so the evidence is the same — only the audience changes.

  • Test case and test plan generation → what a change can reach, what no test covers, and the cases that close the gap.
  • Product and rollout planning → what ships first, what it blocks, and how wide the blast radius is per stage.

Names are not fixed.

Install

/plugin marketplace add aniruddha-adhikary/skills
/plugin install modernizr@ani-skills
/plugin install scale-engineering@ani-skills

modernizr installs three skills and the hooks. scale-engineering installs one skill.

For local development, symlink every skill into ~/.claude/skills:

./scripts/link-skills.sh
  • each entry is a symlink into this repo, so a git pull keeps installed skills current
  • re-run it after you add or rename a skill

What the skills expect on your machine

Nothing, to read them. To run them:

For You need
building and querying a graph Joern and a JDK
resolving dependencies first — do this, it decides whether your answers are real Maven, or the jars by any other route
type-checked query authoring (optional) Coursier, scala-cli, Metals
code-graph Python and networkx
code-symbolic Python, z3-solver, sympy, dd
merging generated code into the graph (optional) the generator your project uses. The bundled JSP example gets Jasper with Coursier

Repo conventions

See CLAUDE.md, also readable as AGENTS.md. The short version:

  • skills stay thin, and route to reference files
  • syntax comes from the tool, not from a copy inside the skill
  • a pattern ships only after somebody measured it on a real codebase, where it beat both ripgrep and plain reading

Two rules the content follows, both learned the hard way:

  • A number belongs in a skill only if you act on its magnitude — a threshold, a parameter.
    Otherwise give the mechanism: "a container is a registry, not a restriction" beats the percentage that proved it.
  • Measured negatives are content. Betweenness centrality, community detection and MC/DC measurably fail on real code.
    Knowing that saves more time than any capability, so the skills document it as carefully as what works.

Reviews (0)

No results found