# Codexqa Code Analyzer

> >

- **Type:** Skill
- **Install:** `agentstack add skill-openqa-cn-codexqa-codexqa-code-analyzer`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [openqa-cn](https://agentstack.voostack.com/s/openqa-cn)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [openqa-cn](https://github.com/openqa-cn)
- **Source:** https://github.com/openqa-cn/codexqa/tree/main/skills/codexqa-code-analyzer
- **Website:** https://openqa.cn

## Install

```sh
agentstack add skill-openqa-cn-codexqa-codexqa-code-analyzer
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Analyzer

Local symbol graph for **quality work**: index first, then answer what changed, who is hit, what is untested, and where an error comes from.

There is **no** `codexqa diff` or `codexqa review`. Review a change with:

```text
index --diff-base   →  change-groups  →  symbol-diff  →  callers / tests / entries
```

Pick the scenario before acting. Do not query or review a diff until an index exists. Do not run full-text search unless the user asked.
`README.md` / `README.zh-CN.md` are human-facing. Do not load them at runtime.

## Documents (load on demand)

Read this file first. Read another file only when the row below applies. Do not preload the whole tree.

| File | Load when |
|---|---|
| `SKILL.md` (this file) | always: routing, report contract, reject conditions |
| [references/playbook.md](references/playbook.md) | entering a scenario (index health / change / defect / implementation / architecture) |
| [references/diagrams.md](references/diagrams.md) | before drawing; copy `init` and `classDef` verbatim |
| [references/cli.md](references/cli.md) | CLI missing, PATH, LLM, or maintenance |
| [references/mcp.json](references/mcp.json) | graph-query tool schema is needed |
| `README.md`, `README.zh-CN.md` | human-facing; not needed by the agent |

## Scenario routing

Open [references/playbook.md](references/playbook.md) and jump to the named section.

| User is asking… | Playbook section |
|---|---|
| Review a PR / what changed / vs main | **Review one change** (index health first) |
| Who is hit / what to regression-test | **Regression scope** under that change section |
| Any unit tests / coverage gaps | **Test gaps** under that change section |
| Which HTTP / RPC / MQ path reaches this | **Entry risk** under that change section |
| Auth, payments, password, token | **Sensitive paths** under that change section |
| Logs, stack, error text, comments | **Locate a defect** |
| How does this function work / who calls it | **Understand an implementation** |
| Module ownership / wrong layer | **Architecture drift** |
| Results are empty / every change is `default` | **Index health** / **Analysis blockers** |

## Report contract

Deliver a **Mermaid evidence report** (graph conclusions + diagrams). Not a product review, and not Archify / interactive HTML.
Read [references/diagrams.md](references/diagrams.md) before drawing. A diagram that misses the quality bar fails the report.

Report body is only these blocks:

- Must-read groups (by risk)
- What changed (trust only `symbol-diff` / `file-source` vs `file-base`)
- Must-test callers / entries (must come from `edges` / `reach` / `path` / `tagged`)
- Test gaps (a tests directory is not a `tests` edge)
- Sensitive paths (write "none" if there are none)
- **Diagrams**: at least one, and it must pass the quality bar

Reject the whole report and rewrite if any of these hold:

- Written as a generic project review (product intro, use cases, scored pros/cons)
- Evidence comes from README / a website / guesswork, not this run of `summary` / `imports` / `source` / `edges` / `reach` / `change-groups` / `symbol-diff`
- Only names large files or high fan-in; never uses `edges` / `reach` to say who is hit
- Infers "covered" from a tests directory name; never checked `tested_count` or `reach --direction in --edge-kinds tests`
- Mermaid is missing the Claude paper `init`, the three `classDef` lines, or a core module that should be `risk` has no `class ... risk`
- Architecture `subgraph` titles are package names (Renderer / Compiler / Shared) instead of **Entry → Application → Domain → Storage**
- Interactive HTML / Archify canvas was generated (this skill does not ask for that)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [openqa-cn](https://github.com/openqa-cn)
- **Source:** [openqa-cn/codexqa](https://github.com/openqa-cn/codexqa)
- **License:** Apache-2.0
- **Homepage:** https://openqa.cn

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-openqa-cn-codexqa-codexqa-code-analyzer
- Seller: https://agentstack.voostack.com/s/openqa-cn
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.