Install the "scan" agent skill from https://github.com/wshobson/agents/tree/main/plugins/ship-mate/skills/scan into .claude/skills/scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan", then confirm the skill loads.
Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
skills CLI
$ npx skills add wshobson/agents --skill scan -a codex
Project install goes to .agents/skills/; add -g for ~/.codex/skills/.
Install the "scan" agent skill from https://github.com/wshobson/agents/tree/main/plugins/ship-mate/skills/scan into .agents/skills/scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan", then confirm the skill loads.
Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
skills CLI
$ npx skills add wshobson/agents --skill scan -a cursor
Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.
Install the "scan" agent skill from https://github.com/wshobson/agents/tree/main/plugins/ship-mate/skills/scan into .cursor/skills/scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan", then confirm the skill loads.
Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
skills CLI
$ npx skills add wshobson/agents --skill scan -a gemini-cli
Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.
Install the "scan" agent skill from https://github.com/wshobson/agents/tree/main/plugins/ship-mate/skills/scan into .gemini/skills/scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan", then confirm the skill loads.
Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
GitHub CLI
$ gh skill install wshobson/agents scan
Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
skills CLI
$ npx skills add wshobson/agents --skill scan -a github-copilot
Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.
Install the "scan" agent skill from https://github.com/wshobson/agents/tree/main/plugins/ship-mate/skills/scan into .github/skills/scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan", then confirm the skill loads.
GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
skills CLI
$ npx skills add wshobson/agents --skill scan -a opencode
OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
Install the "scan" agent skill from https://github.com/wshobson/agents/tree/main/plugins/ship-mate/skills/scan into .opencode/skills/scan/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scan", then confirm the skill loads.
OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
Skill name
scan
GitHub stars
40k
Token cost
~2.2k tokens
SKILL.md length
479 words
Files
1
Skills in repo
142
Repo updated
First seen
Licence
MIT
At a glance
Scans the codebase to generate project-doc.md and AGENTS.md.
Works in 3 steps: Check Optional Plugin Dependencies → Determine Scan Mode → Report
Bootstrapping a new agent-driven repo
SKILL.md covers Step 1: Check Optional Plugin…, Step 2: Determine Scan Mode, Step 3A: Full Scan and Step 3B: Delta Scan, plus 3 more sections
Calls git
What it does
Scan is an agent skill from wshobson/agents. Scans the codebase to generate project-doc.md and AGENTS.md. Use when bootstrapping a new agent-driven repo, refreshing project documentation after architectural changes, or running a delta scan to detect drift. Runs a full scan on first use and a smart delta scan on subsequent runs. Uses understand-anything + context-mode when available, falls back to native tools otherwise. Only updates AGENTS.md on detected architectural changes with human confirmation.
Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Agent Workflows, covering Agent instruction files and Project scaffolding. The repository describes itself as: Multi-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, Google Antigravity, and Pi. The licence is MIT.
When your agent uses it
Bootstrapping a new agent-driven repo
Refreshing project documentation after architectural changes
Running a delta scan to detect drift
Example prompts
“Use the scan skill to scan the codebase to generate project-doc.md and AGENTS.md”
“/scan”
Requirements
Python 3
Node.js
Workflow steps
3 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 46891e7. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
git
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Scan loads about 2.2k tokens when it runs. Until then it costs about 116 tokens; SKILL.md has 479 words of instructions outside code blocks.
Always· name and description, kept in context so the agent knows when to use it
~116
When it runs· the whole SKILL.md, loaded when a task matches
~2.2k
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
Download SKILL.mdSave it as .claude/skills/scan/SKILL.md (or your agent's skills folder).
name
scan
description
Scans the codebase to generate project-doc.md and AGENTS.md. Use when bootstrapping a new agent-driven repo, refreshing project documentation after architectural changes, or running a delta scan to detect drift. Runs a full scan on first use and a smart delta scan on subsequent runs. Uses understand-anything + context-mode when available, falls back to native tools otherwise. Only updates AGENTS.md on detected architectural changes with human confirmation.
Codebase Scanner
You are a technical analyst. Your job is to scan the project codebase and produce accurate, project-specific documentation used by all downstream agents.
Step 1: Check Optional Plugin Dependencies
Check whether the two optional enhancement plugins are available:
understand-anything → /plugin list | grep understand-anything
context-mode → /plugin list | grep context-mode
These plugins are optional. They improve scan quality but are not required:
context-mode (mksglu/context-mode) — routes large outputs through a sandbox to protect the context window
If both are present, use them in Steps 3–4 as described below. If either or both are missing, proceed with the native fallback approach: use find, grep, cat, and git commands directly, routing large outputs through ctx_execute / ctx_execute_file if context-mode is available, otherwise summarise inline.
Use understand-anything to analyse the entire codebase. If context-mode is available (verified in Step 1), route ALL output through its tools (ctx_batch_execute / ctx_execute_file) — never dump raw file contents into the main context window. If context-mode is not available, summarise each file's findings inline and avoid printing raw file contents.
Produce .claude/pipeline/project-doc.md using the following structure (based on the architecture-blueprint-generator pattern):
md
# Project Documentation
> Generated: [timestamp] | Mode: FULL
## Tech Stack
- Runtime: [e.g. Node.js 20, Python 3.11]
- Language: [e.g. TypeScript, Python]
- Framework: [e.g. Next.js 14 App Router, FastAPI]
- Database: [e.g. PostgreSQL via Prisma]
- Styling: [e.g. Tailwind CSS]
- State Management: [e.g. Zustand, Redux]
## Dependencies
[Key libraries with versions, grouped by: core / dev / testing]
## Architecture Pattern
[e.g. Feature-based, Layered MVC, Clean Architecture]
[Describe how the project is structured and why]
## Folder Structure
[Top-level directory map with purpose of each folder]
## Code Style Conventions
[Naming patterns, file naming, import ordering, export patterns]
[Inferred from actual code — not guessed]
## Modularity Practices
[How concerns are separated, shared module locations, service patterns]
## Data Architecture
[Entity relationships, data access patterns, ORM usage]
## Cross-Cutting Concerns
[Auth/authz approach, error handling patterns, logging, validation]
## Service Communication
[REST / GraphQL / event-driven — document what actually exists]
## Test Coverage
- Overall coverage: [X%]
- Testing framework: [e.g. Jest, Vitest, Pytest]
- Key untested areas: [list]
- Test patterns used: [unit / integration / e2e]
## Entry Points
[Main files, key config files, environment setup]
## Changed Files
[Only present in delta scans — list of files re-scanned]
## Last Scanned
[ISO timestamp]
After writing project-doc.md, proceed to Step 4 to generate AGENTS.md.
Step 3B: Delta Scan
Run git diff HEAD~1 --name-only to get changed files
If no changed files, report "No changes detected — project-doc.md is current" and exit
Use understand-anything to re-analyse only the changed files; route output through ctx_execute_file if context-mode is available, otherwise summarise inline
Patch only the affected sections of .claude/pipeline/project-doc.md
Update the Last Scanned and Changed Files fields
Proceed to Step 4B (architectural change detection)
Show full SKILL.md (175 more words)Show less
Step 4A: Generate AGENTS.md (First Run Only)
Write AGENTS.md to the repo root. This is NOT a copy of project-doc.md — it is rewritten as agent instructions, tailored to this specific project. Every agent reads this file first.
Structure:
md
# AGENTS.md — [Project Name]
> Auto-generated by the dev pipeline scanner. Do not edit manually.
> Last updated: [timestamp]
> ⚠️ To update this file, architectural changes must be detected by the scanner and confirmed by a human.
## How to Read This File
Every agent in this pipeline reads this file before doing any work.
It defines the rules, patterns, and guardrails specific to this project.
## Stack Context
[One-line summary: e.g. "Next.js 14 App Router + Prisma + PostgreSQL + Tailwind + Vitest"]
## Code Style Rules
[Written as DO/DON'T instructions inferred from actual codebase patterns]
Example:
- DO use named exports. Default exports are not used in this project.
- DON'T add business logic to API route handlers — delegate to /lib/services/
- DO use [naming convention] for [file type]
## Architecture Guardrails
[Rules derived from the actual architecture — not generic advice]
Example:
- This project uses the Repository pattern. Never query the DB directly from components.
- All API responses must go through the [ResponseWrapper] utility.
## Testing Requirements
[Coverage stat + specific rules for this project]
Example:
- Current coverage: 67%. All new code must include unit tests.
- QA agent: flag any feature with <80% coverage on new code.
- Integration tests use [real DB / mock DB] — do not change this.
## Modularity Conventions
[Specific rules about where code goes]
Example:
- Shared UI components → /components/ui
- Business logic → /lib/services/[domain]/
- Types → /types/[domain].ts
## Security Rules (All Agents)
- Never hardcode secrets, tokens, or credentials
- Use environment variables for all sensitive config
- Flag any auth-adjacent code changes immediately
## Agent-Specific Instructions
### Orchestrator
[Project-specific questions to always ask — e.g. "Does this touch the payment flow?"]
### Architect
[Known complexity areas, performance constraints, patterns to prefer]
[e.g. "This project has a known N+1 issue in /lib/services/orders — avoid adding more eager loading"]
### Developer
[Specific libraries to use, anti-patterns banned in this codebase]
[e.g. "Use dayjs — moment is banned", "Use React Query for all data fetching — no raw fetch()"]
### PR Reviewer
[What counts as 🔴 Critical vs 🟡 Should Fix in this project]
[e.g. "Any change to /lib/auth/ is automatically 🔴 Critical — requires human approval"]
### QA Agent
[Known edge cases for this domain, critical user paths to always test]
[e.g. "Always test empty state, loading state, and error state for every UI feature"]
If the project is MERN stack (MongoDB + Express + React + Node.js — detected from package.json / requirements), append a ### MERN Stack Notes section to AGENTS.md covering: use Mongoose middleware over raw queries, handle async errors in Express with a central error handler, avoid storing JWT tokens in localStorage (use httpOnly cookies), and never expose Mongoose error objects directly in API responses.
After patching project-doc.md, compare the new version against the previous. Check for:
New framework or major library added
New architectural directory pattern created (e.g. new /lib/hooks/, /services/)
Major dependency swap (e.g. axios → fetch, moment → dayjs)
New auth or session handling pattern
If any detected, show:
⚠️ Architectural change detected in delta scan:
[List specific changes found]
AGENTS.md may need updating. Review and confirm:
[y] Update AGENTS.md — patch affected sections only
[n] Skip — this is not an architectural change
Only on [y] confirmation: patch the relevant sections of AGENTS.md. Never rewrite the full file.
Scan next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
Generates AI-BOM, MCP inventory, AI skill inventory, and AI authorship provenance documents with cdxgen, cataloging models, inference services, Hugging Face purls, MCP servers and their…
Turns existing work units or an empty directory into an AI Context Workspace by scanning materials, generating background and conventions, and installing runtime skills.
A skill your agent uses when adding a new remote/network endpoint (a RemoteOperation / OCSRemoteOperation) to this Nextcloud Android library, or when the user says "add an endpoint", "new remote…
Scans a repository for real evidence and proposes, or on request writes, a small stack of root and scoped AGENTS.md files with validation commands and generated-file boundaries.
Writes unit tests for shell scripts with Bats: error-condition tests, fixtures and mocks, cross-shell checks, parallel runs, helper files and CI integration.
Scans the codebase to generate project-doc.md and AGENTS.md. Scan is an agent skill from wshobson/agents.md.
When should I use Scan?
Scan fits situations like: bootstrapping a new agent-driven repo; refreshing project documentation after architectural changes; running a delta scan to detect drift.
How do I install Scan in Claude Code?
Run `npx skills add wshobson/agents --skill scan -a claude-code`. Or copy the skill folder (plugins/ship-mate/skills/scan in wshobson/agents) into .claude/skills/scan in your project. Claude Code loads it when a task matches its description.
How do I install Scan in Codex?
Run `npx skills add wshobson/agents --skill scan -a codex`. Or copy the skill folder (plugins/ship-mate/skills/scan in wshobson/agents) into .agents/skills/scan in your project. Codex loads it when a task matches its description.
Can I use Scan in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add wshobson/agents --skill scan -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/scan, .gemini/skills/scan, .github/skills/scan and .opencode/skills/scan in your project.
What does Scan need to run?
Going by SKILL.md and its folder, Scan needs the command-line tools its instructions call (git). Our summary lists: Python 3; Node.js.
Does Scan access the network?
SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Scan safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Scan use?
Scan is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Scan use?
About 2.2k tokens (SKILL.md is roughly 8.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Scan?
Skills that share tags, products or a category with Scan: Intent Layer (crafter-station/skills, 112 stars), AI Bom (cdxgen/cdxgen, 1.1k stars), AI Context Workspace Init (kvker/ai-context-workspace, 101 stars) and Add Remote Endpoint (nextcloud/android-library, 106 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Scan?
wshobson (a GitHub user) maintains it in wshobson/agents, which has 40,287 GitHub stars. The repository holds 142 skills in this directory. The repository was last updated on October 5, 2026.
Source: wshobson/agents on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
