code-analyze

name	code-analyze
description	Run static analysis, security scans, and dependency checks on .NET code. Use when task involves code quality, security audits, or vulnerability detection. Use when this capability is needed.
metadata	{"author":"giantcroissant-lunar"}

Code Analysis Skill (Entry Map)

Goal: Guide agent to the exact analysis procedure needed.

Quick Start (Pick One)

• Run static code analysis → references/static-analysis.md
• Scan for security issues → references/security-scan.md
• Check dependency vulnerabilities → references/dependency-check.md

When to Use

• Enforce code quality standards and best practices
• Detect potential bugs and code smells
• Identify security vulnerabilities in code
• Check for vulnerable dependencies
• Run automated code reviews

NOT for: building (dotnet-build), testing (dotnet-test), or formatting (code-format)

Inputs & Outputs

Inputs: analysis_type (static/security/dependencies/all), project_path (default: ./dotnet/PigeonPea.sln), severity_filter (error/warning/suggestion)

Outputs: analysis_report (findings with file/line), exit_code (0=clean, 1=issues), metrics (violations by severity)

Guardrails: Analyze only, never modify code, report all findings with context, fail on critical issues

Navigation

1. Static Code Analysis → references/static-analysis.md

• Roslyn analyzers, StyleCop, code quality rules, best practices

2. Security Scanning → references/security-scan.md

• Secret detection (gitleaks, detect-secrets), security analyzers, vulnerability patterns

3. Dependency Vulnerability Check → references/dependency-check.md

• NuGet package vulnerabilities, outdated dependencies, CVE detection

Common Patterns

Quick Analysis (All Checks)

cd ./dotnet
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=true
dotnet list package --vulnerable

Static Analysis Only

cd ./dotnet
dotnet build PigeonPea.sln /p:RunAnalyzers=true /warnaserror

Security Scan (Pre-commit)

pre-commit run gitleaks --all-files
pre-commit run detect-secrets --all-files

Dependency Check

cd ./dotnet
dotnet list package --vulnerable --include-transitive
dotnet list package --outdated

Full Analysis Suite

# Run from repository root
.agent/skills/code-analyze/scripts/analyze.sh --all

Analysis with Specific Severity

cd ./dotnet
# Errors only
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=false

# Warnings as errors
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=true

Troubleshooting

No analyzers found: Verify Roslyn analyzers enabled. See references/static-analysis.md.

Too many warnings: Filter by severity or add suppressions. See references/static-analysis.md.

False positives: Use .editorconfig or suppressions. See references/static-analysis.md.

Secrets not detected: Check .gitleaksignore and .secrets.baseline. See references/security-scan.md.

Dependency scan fails: Network issues or package restore needed. See references/dependency-check.md.

Success Indicators

Static Analysis:

Build succeeded.
    0 Warning(s)
    0 Error(s)

Security Scan:

gitleaks................Passed
detect-secrets...........Passed

Dependency Check:

No vulnerable packages found.

Integration

Before commit: Run security scans (gitleaks, detect-secrets) After build: Run static analysis (Roslyn, StyleCop) Regular checks: Run dependency vulnerability checks

CI/CD Integration: Include all analysis in build pipeline, fail on critical issues

Related

• ./dotnet/ARCHITECTURE.md - Project structure
• .pre-commit-config.yaml - Pre-commit hooks
• .editorconfig - Code style rules
• dotnet-build - Build skill

---

Converted and distributed by TomeVault — claim your Tome and manage your conversions.