Skip to content
Back to skills

Ck Graphify

ASecurity

Build a queryable graph of a codebase from its AST — symbols, imports, call edges, dependency cycles — to support navigation, impact analysis, and refactoring at scale.

  • 3 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 11, 2026
code-qualitypythongosqlnodedebuggingrefactoringcode-reviewapi

Works with

  • api

Security analysis

A100/100

Pro scans all 4 files and shows the line behind each finding

Scanned October 5, 2026

npx -y skills add trungdo9/ClauKit --skill ck-graphify --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Ck Graphify?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Ck Graphify
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/trungdo9-ck-graphify/badge)](https://www.skillsdirectory.com/skills/trungdo9-ck-graphify)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: ck-graphify
description: Build a queryable graph of a codebase from its AST — symbols, imports, call edges, dependency cycles — to support navigation, impact analysis, and refactoring at scale.
category: Codebase Analysis
status: active
---

# Ck Graphify

## Purpose

Convert a codebase into a **queryable graph**: nodes are symbols (files, modules, functions, classes), edges are imports, calls, and inheritance. Used for impact analysis, cycle detection, and large-repo navigation.

Distinct from:
- `[[gkg]]` — semantic knowledge graph from prose/docs (entities + relations from NLP). Different input domain.

**When NOT to use this skill** → write a static diagram (Mermaid / GraphViz) directly for docs; use `[[gkg]]` for extracting knowledge from specs.

## When to Use

- Repo is large enough that "grep + read" stops scaling (>50k LOC)
- Need to answer "what calls this function?" across many files
- Detecting circular imports before they become production bugs
- Estimating blast radius of a refactor (which files change if I rename X?)
- Building a tool that needs structured code understanding

Activation phrases: *"analyze codebase as a graph"*, *"find all call chains from..."*, *"detect circular dependencies"*, *"impact analysis for refactor"*

## Workflow

1. **Parse** — convert source files to ASTs. One parser per language:
   - JS/TS → Babel parser or tree-sitter
   - Python → built-in `ast` module
   - Multi-language → tree-sitter (uniform AST API)
2. **Extract** — walk ASTs to emit nodes (definitions) and edges (uses):
   - Node: `{id, type: file|module|fn|class, name, file, line}`
   - Edge: `{from, to, type: imports|calls|extends, file, line}`
3. **Index** — write to a graph store. Options:
   - **JSON property graph** — simplest; load into memory for query
   - **SQLite with WITH RECURSIVE** — middle ground; persists, queries with SQL
   - **Neo4j / Memgraph** — full graph DB; Cypher queries for serious analysis
4. **Query** — answer questions:
   - Reachability: `nodes reachable from X via calls`
   - Coupling: `nodes with in-degree > threshold`
   - Cycles: strongly connected components in the imports edge set
   - Surface: `nodes with no incoming edges` (dead code candidates)
5. **Render** (optional) — emit query results as Mermaid or GraphViz `dot` for a diagram.

## Tool Choices

| Tool | Strength | Use when |
|---|---|---|
| **tree-sitter** | Language-agnostic, incremental | Multi-language repos |
| **Babel parser** | JS/TS-native, plugin ecosystem | JS/TS-only repos |
| **Python `ast`** | Stdlib, no install | Python projects |
| **dependency-cruiser** | Pre-built JS/TS cycle + complexity reports | JS/TS, want answers not framework |
| **Sourcetrail / Sourcegraph** | Heavyweight, multi-lang, UI | Enterprise codebases |

## Common Pitfalls

- **Dynamic dispatch invisibility**: graph captures static calls; `obj[method]()` or eval-style indirection won't show. Document this in your output.
- **Generated code**: include or exclude consistently; mixed treatment produces phantom edges.
- **Test/source separation**: graph the production code separately from tests, or mark edge type, or you'll get noisy "every test calls every util" coupling metrics.
- **Stale graph**: re-parse on every commit affecting tracked extensions; tree-sitter's incremental mode helps.
- **Identifier collisions**: two functions named `parse` in different modules collapse into one node if you key only by name. Always key by `(file, line, name)`.

## Example Query Set

Once a graph is indexed, these queries are typical first-mile uses:

- `callers(fn_id)` — who calls this function (refactor impact)
- `cycles(edge_type='imports')` — circular dependencies
- `unused()` — symbols with in-degree 0 across calls and exports (dead-code candidates)
- `coupling(file)` — in/out degree distribution per file (high-coupling outliers)
- `path(from, to)` — shortest call-chain between two symbols (bug-flow tracing)

## References

See `references/`:
- `tree-sitter.md` — incremental multi-language parser
- `dependency-cruiser.md` — JS/TS dep analysis with cycle detection
- `python-ast-module.md` — stdlib AST for Python

## Cross-links

`[[gkg]]` (semantic graphs), `[[code-review]]`, `[[debugging]]`

Files in this skill

  • SKILL.md4.3 KB
  • references/dependency-cruiser.md1.5 KB
  • references/python-ast-module.md1.8 KB
  • references/tree-sitter.md1.6 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…