scope-repo
Decide audit boundaries for large or monorepo targets and write audit-plan.md.
Best use case
scope-repo is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Decide audit boundaries for large or monorepo targets and write audit-plan.md.
Teams using scope-repo should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/scope-repo/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How scope-repo Compares
| Feature / Agent | scope-repo | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Decide audit boundaries for large or monorepo targets and write audit-plan.md.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Scope Repo Use this task skill when the user asks to scope this repo, decide where to focus, decide what to audit first, or handle a large codebase. ## Workflow 1. Trigger `large-codebase-check` when repository size or monorepo structure is unclear. 2. Run `/vuln-scout:scope --list` for workspace discovery when applicable. 3. Run `/vuln-scout:scope <path> --compress --name <scope-name>` for the selected boundary. 4. Call `app-mapper` to produce `.claude/app-understanding.md`. 5. Write or update `.claude/audit-plan.md` with scope name, workspace list, entry points, trust boundaries, and high-risk modules. ## Produces - `.claude/audit-plan.md` - workspace list - scope name ## When NOT To Trigger Do not trigger for STRIDE-only modeling, dangerous-function lookup, framework pattern questions, or vulnerability-specific education unless the user asks for audit scoping.
Related Skills
Workspace Discovery
This skill should be used when the user asks to "detect workspaces", "find packages", "list monorepo packages", "workspace structure", "monorepo analysis", or needs to identify workspace/package boundaries in a codebase for focused security analysis.
vulnerability-chains
This skill should be used when the user asks about "vulnerability chains", "chained exploits", "multi-step attacks", "SSRF to RCE", "pivot attacks", or needs to identify how vulnerabilities in different components can be combined during whitebox security review.
Vulnerability Patterns
This skill should be used when the user asks about "vulnerability patterns", "how to find SQL injection", "XSS patterns", "command injection techniques", "OWASP vulnerabilities", "common web vulnerabilities", "exploitation patterns", or needs to understand how specific vulnerability classes work during whitebox security review.
Threat Modeling
This skill should be used when the user asks about "threat model", "STRIDE", "data flow diagram", "attack surface", "threat analysis", "security architecture", "component threats", "trust boundaries", "technology decomposition", or needs systematic threat identification during whitebox security review.
verify-finding
Drive a single finding through CPG verification and false-positive triage.
start-audit
Guided first-run security audit: doctor, scope, threats, scan, verify, report.
review-pr
Diff-aware PR security review with verified findings and PR comment payload.
package-evidence
Bundle findings, reports, audit plan, and ledger into one evidence zip.
Sensitive Data Leakage
Detect ANY credential/secret flowing to ANY output sink. Use when asked about "credential leakage", "secret logging", "sensitive data exposure", "CWE-532", "password in logs", "token exposure", or security logging issues.
Security Misconfiguration
This skill should be used when the user asks about "security misconfiguration", "default credentials", "debug mode", "security headers", "exposed endpoints", "TLS configuration", or needs to find configuration-related vulnerabilities during whitebox security review.
Secret Scanning
This skill should be used when the user asks about "secret scanning", "find secrets", "hardcoded credentials", "leaked API keys", "git history secrets", "credential scanning", "detect passwords in code", or needs to identify secrets and credentials in source code or git history during whitebox security review.
Sandbox Escapes
This skill should be used when the user asks about "sandbox escape", "vm escape", "template injection to RCE", "SSTI exploitation", "vm2 bypass", "restricted execution bypass", "sandbox breakout", or needs to identify sandbox escape and template engine exploitation techniques during whitebox security review.