Install
$ agentstack add skill-nicolasapr-contract-tree-map-modules ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Map Modules
Bootstrap a contract tree. Two entry modes, one output: a CONTRACT.md in each module directory plus a .contract-tree/tree.md index at the repo root.
Read references/contract-format.md first — it is the canonical on-disk format. Do not invent field names.
Which mode
- Legacy — the code already exists; extract contracts from it.
- Greenfield — no code yet; design the tree and contracts first, then let code
fill the declared entrypoints.
You can also run legacy mode on just one area of a large repo — you do not have to map everything at once.
Legacy mode (extract from code)
Read references/extraction-heuristics.md for how to find boundaries and infer fields. Then:
- Walk the directory tree of the target area. Identify module candidates —
directories with a cohesive purpose behind a small public surface.
- Go bottom-up: characterize leaf modules (no upstream) first, then parents.
- For each module, draft a
CONTRACT.md: inferentrypointsfrom public
exports, io.input/io.output from their signatures, upstream from cross-module imports, and invariants from what the code guarantees.
- Apply the granularity stop rule — don't make a contract per tiny file; stop
when a module is one boundary / one purpose.
- Present the drafts for review. Extraction is a proposal; the user corrects
intent the code doesn't state. Do not commit contracts silently.
- Generate
.contract-tree/tree.mdfrom the approved contracts: one indented
line per module, → edges pointing at each module's downstream (derived by inverting upstream), (leaf) where none.
Greenfield mode (design first)
- Interview the user about the top-level split: what are the root modules,
and how does each divide (the "2 modules → 5 each" shape)? Keep dividing only while each piece stays one boundary / one purpose.
- For each planned module, write a
CONTRACT.mdwith purpose, intended
io.input/io.output, upstream, invariants, and the entrypoints the code will expose (files/symbols that don't exist yet — that's fine; they are the contract the code must fulfill).
- Generate
.contract-tree/tree.mdfrom those contracts. - Code is then written to fill the declared entrypoints, and
change-with-contracts governs later edits.
Output checklist
- Every module directory in scope has a
CONTRACT.mdvalid per
references/contract-format.md.
.contract-tree/tree.mdexists at the repo root, its edges match the contracts'
upstream relations (inverted), and its header note names the contracts as the I/O source of truth.
- Only
upstreamwas authored;downstreamwas derived, never hand-written.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: nicolasapr
- Source: nicolasapr/contract-tree
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.