Back to skills
SKILL.md
Repo Scanner
ASecurityScans a GitHub repository to understand its tech stack, hosting, monitoring, integrations, and current production readiness. Use when the user asks to "audit", "check", or "scan" their repo. Don't use for code review or bug detection.
- 5 stars
- 0 votes
- 0 copies
- 3 views
- Added September 8, 2026
Works with
Security analysis
100/100npx -y skills add The-Utopia-Studio/skills --skill repo-scanner --agent claude-codeAre you the author of Repo Scanner?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/the-utopia-studio-repo-scanner-skills)---
name: repo-scanner
description: Scans a GitHub repository to understand its tech stack, hosting, monitoring, integrations, and current production readiness. Use when the user asks to "audit", "check", or "scan" their repo. Don't use for code review or bug detection.
---
# Repo Scanner
Scans any repository to build a complete picture of the current technical setup and scores production readiness.
## How It Works
1. Read the root directory tree to identify project type and structure
2. Detect the tech stack from config files
3. Check for production infrastructure (CI/CD, Docker, hosting)
4. Check for observability (monitoring, error tracking, logging)
5. Check for developer experience (documentation, agent config, tooling)
6. Output a structured scan report using the EXACT format below
## Step-by-Step Procedure
### Step 1: Read Directory Structure
```bash
find . -type f -not -path './.git/*' -not -path './node_modules/*' -not -path './.next/*' -not -path './dist/*' -not -path './__pycache__/*' -not -path './venv/*' | head -200
```
### Step 2: Detect Tech Stack
Check for these files to determine the stack:
| File | Stack |
|------|-------|
| `package.json` | Node.js / JavaScript / TypeScript |
| `tsconfig.json` | TypeScript |
| `next.config.*` | Next.js |
| `vite.config.*` | Vite |
| `requirements.txt` / `pyproject.toml` | Python |
| `go.mod` | Go |
| `Cargo.toml` | Rust |
| `Gemfile` | Ruby |
Read `package.json` or equivalent to understand dependencies and scripts.
### Step 3: Check Production Infrastructure
| Check | How |
|-------|-----|
| **CI/CD** | Look for `.github/workflows/`, `.gitlab-ci.yml`, `Jenkinsfile` |
| **Docker** | Look for `Dockerfile`, `docker-compose.yml`, `.dockerignore` |
| **Hosting** | Look for `vercel.json`, `railway.toml`, `fly.toml`, `render.yaml`, `serverless.yml` |
| **Environments** | Look for `.env.example`, `.env.local`, `.env.production` |
| **Build** | Check for build scripts in `package.json` or `Makefile` |
### Step 4: Check Observability
| Check | How |
|-------|-----|
| **Error tracking** | Grep for `sentry`, `@sentry/`, `posthog`, `datadog`, `bugsnag` in deps or code |
| **Analytics** | Grep for `gtag`, `analytics`, `mixpanel`, `amplitude` |
| **Logging** | Check for structured logging (winston, pino, structlog, loguru) |
| **Health checks** | Look for `/health`, `/healthz`, `/api/health` endpoints |
### Step 5: Check Developer Experience
| Check | How |
|-------|-----|
| **Root README** | Does `README.md` exist with setup instructions? |
| **Directory READMEs** | `find . -name "README.md" -not -path './node_modules/*' | wc -l` |
| **Agent config** | Look for `AGENTS.md`, `.cursorrules`, `.cursor/rules/`, `.claude/` |
| **Linting** | Look for `.eslintrc`, `.prettierrc`, `ruff.toml` |
| **Testing** | Look for `__tests__/`, `tests/`, `spec/`, test scripts |
| **Git hygiene** | Check `.gitignore` exists and covers common patterns |
### Step 6: Check Security
```bash
grep -rn "sk-\|api_key\s*=\s*['\"].\+['\"]" --include="*.ts" --include="*.js" --include="*.py" --include="*.env" . 2>/dev/null | grep -v node_modules | grep -v '.env.example' | head -20
```
## MANDATORY Output Format
**You MUST use this exact markdown structure. Do not invent your own format.**
````markdown
## π Repo Scan: {project-name}
**Tech Stack:** {e.g. React 18 + TypeScript, Flask + Python 3.11}
**Hosting:** {e.g. Vercel, AWS, Railway, or "Not configured"}
**Framework:** {e.g. Next.js 14, Vite 5, FastAPI}
---
## π Production Readiness Score: {X}/10
| # | Category | Status | Details |
|---|----------|--------|---------|
| 1 | Environment Setup | {β
/β οΈ/β} | {one-line detail} |
| 2 | CI/CD Pipeline | {β
/β οΈ/β} | {one-line detail} |
| 3 | Documentation | {β
/β οΈ/β} | {one-line detail} |
| 4 | Error Tracking | {β
/β οΈ/β} | {one-line detail} |
| 5 | Deployment | {β
/β οΈ/β} | {one-line detail} |
| 6 | Security | {β
/β οΈ/β} | {one-line detail} |
| 7 | Cost Awareness | {β
/β οΈ/β} | {one-line detail} |
| 8 | Integration Health | {β
/β οΈ/β} | {one-line detail} |
| 9 | LLM-Readiness | {β
/β οΈ/β} | {one-line detail} |
| 10 | Code Organization | {β
/β οΈ/β} | {one-line detail} |
**Scoring: β
= 1 point, β οΈ = 0.5 points, β = 0 points**
---
## π¨ Top 3 Issues
1. **{Issue title}** β {Why it matters. File:line reference if applicable.}
2. **{Issue title}** β {Why it matters.}
3. **{Issue title}** β {Why it matters.}
---
## π οΈ Recommended Next Steps
Run these vibe-to-prod skills to fix the issues above:
1. `skills/{skill-name}/` β {what it will fix}
2. `skills/{skill-name}/` β {what it will fix}
3. `skills/{skill-name}/` β {what it will fix}
````
**Rules for the output:**
- Use the EXACT table format above with β
/β οΈ/β status icons
- Score is X/10 where β
=1, β οΈ=0.5, β=0
- Top 3 issues must include specific file:line references when possible
- Recommended next steps must reference actual skill directory names
- Keep the entire output under 100 lines
- Do NOT add extra sections, executive summaries, or risk assessments
Attribution
Related skills
View all in development βComments
Loading commentsβ¦
Newsletter
Get the weekly list of safe new skills, and the ones we pulled.