drupal-code-provenance
Drupal Code Provenance
Overview
In a Drupal project the code that runs on the server splits into two very different piles.
Drupal core and every contrib module, theme, and profile are community code: reviewed, released,
and maintained by thousands of people. The code under modules/custom, themes/custom, and
profiles/custom is what you and the agent wrote for this one site, and it has had none of that
scrutiny. Server-side PHP is where the real risk lives (access checks, queries, form handlers), so
custom PHP is the "dangerous" code worth measuring on its own.
This skill runs a script that counts SLOC (source lines, skipping blank and comment-only lines) and answers one question: how much of the running code did the agent write, versus the community. It reports server-side PHP and frontend separately, because a large custom frontend is far less dangerous than a large custom backend.