360 Secure SkillHub
360 安全技能中心

call-chain

基于代码知识图谱追踪函数执行路径:接受函数名或入口点,输出缩进调用树、Mermaid 流程图,并按文件跨度、安全敏感度、外部调用、测试缺口与深度给出关键性评分;缺少图谱数据时可回退为 grep/rg 静态分析。

athola
athola
热度 63.17
最近更新 2026-08-26 21:08:56
分类:开发依赖:代码执行 / 读写文件应用场景:代码审查

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add nm-cartograph-call-chain
Metadata
name
call-chain
description
Traces execution paths through the code graph with criticality scoring and Mermaid charts
version
1.9.8
triggers
["understanding how a function propagates through the system"]
metadata
{"openclaw":{"homepage":"https://github.com/athola/claude-night-market/tree/master/plugins/cartograph","emoji":"🦞"}}
source
claude-night-market
source_plugin
cartograph

Night Market Skill — ported from claude-night-market/cartograph. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Call Chain Tracing

Trace execution flows through the codebase using the code knowledge graph.

Prerequisites

This skill requires the gauntlet plugin for graph data. Discover it:

GRAPH_QUERY=$(find ~/.claude/plugins -name "graph_query.py" -path "*/gauntlet/*" 2>/dev/null | head -1)

If gauntlet is not installed: Fall back to static analysis. Use grep to trace function calls and build a Mermaid diagram manually from import/call patterns. Skip graph-specific steps.

If installed but no graph.db: Tell the user to run /gauntlet-graph build.

Steps

  1. Accept target: Get a function name or entry point from the user (or trace all entry points).

  2. Run flow tracing (requires gauntlet):

    python3 "$GRAPH_QUERY" --action flows --depth 15
    

    To filter by entry point:

    python3 "$GRAPH_QUERY" --action flows --entry "main"
    

    Fallback (no gauntlet): Trace calls with rg (or grep):

    # Prefer rg (ripgrep) for speed; fall back to grep
    if command -v rg &>/dev/null; then
      rg -n "function_name\(" --type py . | head -20
    else
      grep -rn "function_name(" --include="*.py" . | head -20
    fi
    

    Build the call tree manually from search results.

  3. Display as indented tree:

    main() [criticality: 0.72]
      -> validate_input()
        -> parse_config()
      -> process_data()
        -> db.execute_query()
        -> cache.store()
      -> send_response()
    
  4. Generate Mermaid flowchart:

    flowchart LR
      main --> validate_input
      main --> process_data
      main --> send_response
      validate_input --> parse_config
      process_data --> db.execute_query
      process_data --> cache.store
    
  5. Show criticality breakdown:

    • File spread: how many files the flow touches
    • Security sensitivity: auth/crypto code in the path
    • Test coverage gaps: untested nodes in the flow

Criticality Scoring

Factor Weight Meaning
File spread 0.30 Touches many files
Security 0.25 Contains auth/crypto code
External calls 0.20 Unresolved dependencies
Test gap 0.15 Untested nodes in flow
Depth 0.10 Deep call chains