assessing-impact — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited assessing-impact (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Cheap, ad-hoc impact analysis for a single target. Not a graph database — a focused walk over an AST cache plus a complementary text scan, clustered into a report that's easy to summarize.
Use this when you're about to refactor / rename / delete a symbol in a repo you don't work in daily, and you want a single artifact that says: "these N files will need to change, in these M packages, with these tests likely affected."
Don't use this for deep ongoing impact analysis on your own codebase — stand up GitNexus, SourceGraph, or your IDE's index. This skill is for the one-shot case.
uv venv /home/claude/.venv 2>/dev/null
uv pip install --python /home/claude/.venv/bin/python tree-sitter
export PYTHON=/home/claude/.venv/bin/python
export IMPACT=/mnt/skills/user/assessing-impact/scripts/impact.pyThe script depends on the tree-sitting skill — it imports engine.py directly. The bundled grammars live with tree-sitting; no separate language-pack install needed.
$PYTHON $IMPACT /path/to/repo SYMBOL_NAMEOr target a whole file:
$PYTHON $IMPACT /path/to/repo path/to/module.pyThe script prints a structured markdown report. Treat it as input for your final summary, not the deliverable. It deliberately doesn't assign a "high/medium/low" risk label — that's your job, after weighing:
If a particular package looks suspicious, follow up with tree-sitting to read the actual call sites:
TREESIT=/mnt/skills/user/tree-sitting/scripts/treesit.py
$PYTHON $TREESIT /path/to/repo --no-tree 'source:caller_function'| Flag | Default | Purpose |
|---|---|---|
--features PATH | _FEATURES.md | Root _FEATURES.md — when present, refs get clustered by feature in addition to by package. |
--skip DIRS | (defaults from tree-sitting) | Extra comma-separated dirs to skip. |
--limit-per-name N | 500 | Cap refs per symbol name. Bump if you suspect truncation. |
--json | off | Emit JSON instead of markdown — for downstream tooling. |
# Impact Report: <target>
## Target
Kind, definition sites with line ranges.
## Direct & Textual References (N total)
Top-line counts, then refs grouped by:
- Code references by package
- Test references
- Documentation mentions
## Affected Features (from _FEATURES.md) ← only if file present
Feature name → ref count + file count.
## Suggested Test Surfaces
Test files that already reference the target, plus tests neighboring
the definition. Likely the regression net for the change.
## Caveats
What the scan can't see (dynamic dispatch, cross-language, cross-repo).generated _FEATURES.md — the impact report will cluster refs by feature, which makes the blast radius story much more legible than raw package directories.
identified them.
same corpus rather than impact analysis on a known target.
type-resolved call edges. Common names (run, init, handler) will pick up unrelated symbols. Prefer running this on distinctive names; otherwise expect noise and read the snippets.
getattr, duck-typedmethod calls, virtual dispatch in C++) is missed or over-matched.
handler over HTTP appears as zero refs — they're not in the same AST.
packages, sibling services) are invisible. For multi-repo impact, reach for GitNexus / SourceGraph.
acceptable cost (~700ms scan + sub-ms queries) for a few hundred files.
Diff → affected-symbols extraction is a planned follow-up.
scripts/impact.py — Single-entry CLI. Resolves target → walks ASTrefs → augments with text scan → clusters by package and (optionally) by feature → renders markdown or JSON.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.