# Code Blast Radius

> Maps all callers, importers, and dependents of a target function, class, module, or file before a refactor begins. Scores blast radius as low/medium/high and flags high-risk downstream effects so nothing breaks silently. Trigger phrases: "blast radius", "who calls this", "what depends on", "safe to rename", "safe to move", "what imports this", "refactor radar", "dependency map", "what breaks if I change", "callers of", "dependents of", "impact analysis before refactor", "check before refactoring". Do NOT use for: general code search, finding bugs, reviewing pull requests, auditing security, checking for dead code (use /code-security), detecting scope creep (use /session-drift), evaluating architecture options (use /plan-directions), or any task that is not specifically about pre-refactor impact analysis.

- Skill: `gridlock-nyc/code-blast-radius` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gridlock-nyc/code-blast-radius`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gridlock-nyc/code-blast-radius/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: GRIDLOCK-NYC (https://skillmd.com/u/gridlock-nyc)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gridlock-nyc/code-blast-radius

---


## Important

This skill runs BEFORE any code changes. Its only job is to map impact so you can decide whether the
refactor is safe to proceed. It never modifies files. If the blast radius is HIGH, it stops and reports —
it does not attempt to fix anything. Always run this before renaming, moving, or restructuring any
module, class, or function that other code depends on.

## Instructions

1. **Identify the target.** Confirm with the user exactly what is being refactored: a function name,
   class name, file path, or module. If ambiguous, ask before proceeding.

2. **Find all direct references.** Search the codebase for every location that imports, calls, or
   instantiates the target. Use Grep with appropriate patterns:
   - For functions: search for the function name as a call site (`target_name(`, `.target_name(`)
   - For classes: search for import statements, inheritance (`class Foo(Target)`), and instantiation (`Target(`)
   - For files/modules: search for import paths (`from path.to.module import`, `require('path/to/module')`,
     `import 'path/to/module'`)
   - For TypeScript/JavaScript: also check re-exports (`export { ... } from`)

3. **Find all indirect references.** For each direct caller found in step 2, check whether that caller
   is itself exported or re-exported. This surfaces second-order blast radius. Limit to two hops to
   avoid unbounded recursion — flag if deeper chains exist.

4. **Categorize findings by type:**
   - **Callers** — functions/methods that call the target directly
   - **Importers** — files that import the target (may or may not use it)
   - **Inheritors** — classes that extend or implement the target
   - **Re-exporters** — modules that re-export the target to other consumers
   - **Test files** — test files that reference the target (separate category — tests break silently)

5. **Score blast radius.**
   - **LOW** — 1-3 files, no re-exports, no inheritance, target is internal/private
   - **MEDIUM** — 4-10 files, or any re-export, or used across 2+ top-level directories
   - **HIGH** — 11+ files, or public API surface, or re-exported, or inherited by multiple classes,
     or used in test fixtures/mocks

6. **Flag high-risk patterns.** Specifically call out:
   - Files in `node_modules` or third-party code that reference the target (rare but critical)
   - Dynamic references: string-based imports, `require(variable)`, `getattr(obj, name)` — these
     cannot be found by static search and must be flagged as undetectable risk
   - Missing test coverage for callers (callers with no corresponding test file)
   - Cross-package usage (monorepos where the target is imported by a different package)

7. **Output a structured report.**
   ```
   ## Refactor Radar — [target name]

   Blast Radius: [LOW / MEDIUM / HIGH]

   ### Direct References ([count] files)
   - path/to/caller.ts — [type: caller / importer / inheritor]
   - ...

   ### Indirect References ([count] files, 2-hop)
   - path/to/indirect.ts — via [intermediate file]
   - ...

   ### Test Coverage
   - [file] — covered by [test file] / UNCOVERED
   - ...

   ### High-Risk Flags
   - [flag description] — [file or pattern]

   ### Recommendation
   [Safe to proceed / Proceed with caution — update N files / High risk — review before changing]
   ```

8. **Stop if HIGH.** When blast radius is HIGH, end the report with a clear recommendation to review
   the full list before making any changes. Do not begin refactoring. Let the user decide.

## Error Handling

- **Target not found in codebase:** Report "No references found for [target]. Either the name is
  misspelled, it is unused (dead code), or it is referenced only through dynamic patterns." Do not
  proceed.
- **Ambiguous target name (common word):** Warn the user that the search term is generic and results
  may include false positives. List the top matches and ask for confirmation of which one is the
  intended target before scoring blast radius.
- **Binary/generated files in results:** Exclude `dist/`, `build/`, `.next/`, `__pycache__/`, and
  other generated directories from the scan. Note that generated files were excluded.
- **Monorepo with many packages:** Note that the scan covers the local workspace. If the target is
  published as an npm/pip package consumed externally, external consumers cannot be detected.

## Examples

**Example 1 — Low blast radius**
User: "I want to rename `formatDate` in `src/utils/dates.ts`. Is it safe?"
Skill finds 2 callers in `src/components/`, 1 test file. No re-exports, no inheritance.
Output: Blast Radius LOW. 3 files need updating. Safe to proceed.

**Example 2 — High blast radius**
User: "Blast radius on moving `ApiClient` class out of `src/api/client.ts`"
Skill finds 14 direct importers across 4 packages, 3 classes that extend it, 2 re-export files.
Output: Blast Radius HIGH. 19 files affected. Flags 3 uncovered callers and 1 dynamic `require()`.
Recommendation: review full list before changing.

**Example 3 — Dynamic reference warning**
User: "What depends on `get_model` in models/registry.py?"
Skill finds 5 static callers, but also detects `getattr(registry, model_name)` patterns in 2 files.
Output: Blast Radius MEDIUM (5 static) + flags 2 files with undetectable dynamic references.