360 Secure SkillHub
360 安全技能中心

call-chain

核心功能:基于代码知识图谱或静态分析追踪代码执行路径,生成缩进式调用树、Mermaid可视化流程图,并从文件分布、安全敏感度等多维度计算关键度评分。典型场景:用于理解函数在系统中的传播路径。输入为函数名或入口点,输出含结构化调用关系、可视化图表及关键度拆解说明,依赖gauntlet插件,无插件时可静态分析 fallback。

athola
athola
热度 63.20
最近更新 2026-08-26 21:08:56
分类:开发依赖:代码执行 / MCP 服务应用场景:调试排错 / 代码审查

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add nm-cartograph-call-chain
Metadata
name
call-chain
description
Traces execution paths through the code graph with criticality scoring and Mermaid charts
version
1.9.8
triggers
["understanding how a function propagates through the system"]
metadata
{"openclaw":{"homepage":"https://github.com/athola/claude-night-market/tree/master/plugins/cartograph","emoji":"🦞"}}
source
claude-night-market
source_plugin
cartograph

Night Market Skill — ported from claude-night-market/cartograph. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Call Chain Tracing

Trace execution flows through the codebase using the code knowledge graph.

Prerequisites

This skill requires the gauntlet plugin for graph data. Discover it:

GRAPH_QUERY=$(find ~/.claude/plugins -name "graph_query.py" -path "*/gauntlet/*" 2>/dev/null | head -1)

If gauntlet is not installed: Fall back to static analysis. Use grep to trace function calls and build a Mermaid diagram manually from import/call patterns. Skip graph-specific steps.

If installed but no graph.db: Tell the user to run /gauntlet-graph build.

Steps

  1. Accept target: Get a function name or entry point from the user (or trace all entry points).

  2. Run flow tracing (requires gauntlet):

    python3 "$GRAPH_QUERY" --action flows --depth 15
    

    To filter by entry point:

    python3 "$GRAPH_QUERY" --action flows --entry "main"
    

    Fallback (no gauntlet): Trace calls with rg (or grep):

    # Prefer rg (ripgrep) for speed; fall back to grep
    if command -v rg &>/dev/null; then
      rg -n "function_name\(" --type py . | head -20
    else
      grep -rn "function_name(" --include="*.py" . | head -20
    fi
    

    Build the call tree manually from search results.

  3. Display as indented tree:

    main() [criticality: 0.72]
      -> validate_input()
        -> parse_config()
      -> process_data()
        -> db.execute_query()
        -> cache.store()
      -> send_response()
    
  4. Generate Mermaid flowchart:

    flowchart LR
      main --> validate_input
      main --> process_data
      main --> send_response
      validate_input --> parse_config
      process_data --> db.execute_query
      process_data --> cache.store
    
  5. Show criticality breakdown:

    • File spread: how many files the flow touches
    • Security sensitivity: auth/crypto code in the path
    • Test coverage gaps: untested nodes in the flow

Criticality Scoring

Factor Weight Meaning
File spread 0.30 Touches many files
Security 0.25 Contains auth/crypto code
External calls 0.20 Unresolved dependencies
Test gap 0.15 Untested nodes in flow
Depth 0.10 Deep call chains