SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillscode-analyze

code-analyze

Security & auditing

View repository

Updated 10-15 22:16

About this skill

Code Analysis Skill (Entry Map)

Goal: Guides the agent to accurately find the necessary analysis procedures.

Quick Start (choose one)

  • Run static code analysis → references/static-analysis.md
  • Scan for security issues → references/security-scan.md
  • Check dependency vulnerabilities → references/dependency-check.md

When to Use

  • Enforce code quality standards and best practices
  • Detect potential bugs and code smells
  • Identify security vulnerabilities in code
  • Check vulnerable dependencies
  • Run automated code review

Not for: build (dotnet-build), test (dotnet-test), or formatting (code-format)

Inputs & Outputs

Inputs: analysis_type (static/security/dependencies/all), project_path (default: ./dotnet/PigeonPea.sln), severity_filter (error/warning/suggestion)

Outputs: analysis_report (results including file/line), exit_code (0=clean, 1=issues), metrics (violations by severity)

Guardrails: Perform analysis only and never modify code. Report all results with context and treat any critical issues as failure.

Navigation

1. Static Code Analysis → references/static-analysis.md

  • Roslyn analyzers, StyleCop, code quality rules, best practices

2. Security Scanning → references/security-scan.md

  • Secret detection (gitleaks, detect-secrets), security analyzers, vulnerability patterns

3. Dependency Vulnerability Check → references/dependency-check.md

  • NuGet package vulnerabilities, outdated dependencies, CVE detection

Common Patterns

Quick Analysis (run all checks)

cd ./dotnet
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=true
dotnet list package --vulnerable

Static Analysis only

cd ./dotnet
dotnet build PigeonPea.sln /p:RunAnalyzers=true /warnaserror

Security Scan (before commit)

pre-commit run gitleaks --all-files
pre-commit run detect-secrets --all-files

Dependency Check

cd ./dotnet
dotnet list package --vulnerable --include-transitive
dotnet list package --outdated

Full Analysis Suite

# 저장소 루트에서 실행
.agent/skills/code-analyze/scripts/analyze.sh --all

Analysis including specific severity

cd ./dotnet
# 에러 전용
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=false

# 경고를 에러로 처리
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=true

Troubleshooting

Cannot find analyzer: Check whether Roslyn analyzers are enabled. references/static-analysis.md.

Too many warnings: Filter by severity or add suppression. references/static-analysis.md.

False positives: .editorconfig or use suppression. references/static-analysis.md.

No secrets detected: .gitleaksignore 및 .secrets.baselineCheck references/security-scan.md.

Dependency scan failed: Network issues or package restore may be required. references/dependency-check.md.

Success Indicators

Static Analysis:

Build succeeded.
    0 Warning(s)
    0 Error(s)

Security Scan:

gitleaks................Passed
detect-secrets...........Passed

Dependency Check:

No vulnerable packages found.

Integration

Before commit: Run security scan (gitleaks, detect-secrets) After build: Run static analysis (Roslyn, StyleCop) Regular check: Run dependency vulnerability check

CI/CD Integration: Include all analyses in the build pipeline and treat critical issues as failure

Related