reporeview

A Claude Code skill that analyses a GitHub repository and produces an adoption decision instead of a summary.

Point it at a repo URL and it runs three parallel research agents, then writes a four-part report: trustworthiness, security, extractable components, and a concrete integration plan with adapted code you can paste into your own scripts.

---

What it does

Section	Question it answers
A — Trustworthiness	Is this project alive? Stars, maintainers, release cadence, issue health, licence.
B — Security	Is it safe to run near my files and credentials? Network behaviour, telemetry, dependency risk, known CVEs. Verdict: PASS / CAUTION / REJECT.
C — Extractable components	Which specific algorithms, data structures, or automation hooks can I lift out — and how hard is each to port?
D — Integration plan	Where exactly does each component go in my setup, with adapted code and a test command.

If section B returns REJECT, the skill stops — no adoption plan is written for something that failed the security review.

The core idea: most repos are not worth installing, but many contain one clever function worth stealing. This skill separates those two questions.

---

Install

Copy the skill into your Claude Code skills directory:

# personal (all projects)
cp -r skills/reporeview ~/.claude/skills/

# or per-project
cp -r skills/reporeview .claude/skills/

Then use it:

/reporeview https://github.com/owner/repo

Requires Python 3.9+ for the helper script (standard library only, no dependencies).

---

Configuration

Nothing is hardcoded to a particular machine. Two optional environment variables control where output lands:

Variable	Default	Purpose
REPOREVIEW_NOTES_DIR	~/notes/reporeview	Where reports are saved as markdown (works with Obsidian, plain folders, anything)
REPOREVIEW_STATE_DIR	~/.reporeview	History log and rating records

Check the resolved paths:

python3 skills/reporeview/scripts/reporeview.py show-config

---

Helper script

scripts/reporeview.py handles the bookkeeping around the analysis:

reporeview.py extract-slug   "https://github.com/owner/repo"   # -> owner/repo
reporeview.py save-report    owner/repo /tmp/report.md         # -> saved path
reporeview.py log-history    '{"repo_name": "...", "security_verdict": "pass"}'
reporeview.py save-pending   '{"topic": "owner/repo"}'
reporeview.py process-rating "ri4"
reporeview.py show-config

Reports are saved as YYYY-MM-DD-owner-repo.md with YAML front matter, so they index cleanly in note-taking apps.

Ratings

After each analysis the skill asks how useful it was (ri0–ri5). The answer is appended to ratings.jsonl alongside the repo name, which builds a record of which kinds of repos actually yield something worth adopting.

---

Adapting it to your own setup

Section D of the skill refers to a generic automation chain:

• ~/scripts/ — your own helper scripts
• ~/.claude/commands/ — your own slash commands
• a scheduler layer — cron, systemd timers, or launchd
• a cloud automation layer — Apps Script, Workers, Lambda
• a markdown notes vault

Edit those references in SKILL.md to match your actual setup so the integration plans target real files on your machine.

---

Safety notes

• The skill reads repository source; it never installs or executes the analysed project's code.
• Section B explicitly checks whether a project could reach personal document folders, .env files, or stored API credentials.
• The skill is instructed never to send personal notes, API keys, or private data to third parties.

---

Licence

MIT — see LICENSE.