Code Analysis Skill (Entry Map)

Goal: Guide agent to the exact analysis procedure needed.

Quick Start (Pick One)

• Run static code analysis → references/static-analysis.md
• Scan for security issues → references/security-scan.md
• Check dependency vulnerabilities → references/dependency-check.md

When to Use

• Enforce code quality standards and best practices
• Detect potential bugs and code smells
• Identify security vulnerabilities in code
• Check for vulnerable dependencies
• Run automated code reviews

NOT for: building (dotnet-build), testing (dotnet-test), or formatting (code-format)

Inputs & Outputs

Inputs: analysis_type (static/security/dependencies/all), project_path (default: ./dotnet/PigeonPea.sln), severity_filter (error/warning/suggestion)

Outputs: analysis_report (findings with file/line), exit_code (0=clean, 1=issues), metrics (violations by severity)

Guardrails: Analyze only, never modify code, report all findings with context, fail on critical issues

Navigation

1. Static Code Analysis → `references/static-analysis.md`

• Roslyn analyzers, StyleCop, code quality rules, best practices

2. Security Scanning → `references/security-scan.md`

• Secret detection (gitleaks, detect-secrets), security analyzers, vulnerability patterns

3. Dependency Vulnerability Check → `references/dependency-check.md`

• NuGet package vulnerabilities, outdated dependencies, CVE detection

Common Patterns

Quick Analysis (All Checks)

cd ./dotnet
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=true
dotnet list package --vulnerable

Static Analysis Only

cd ./dotnet
dotnet build PigeonPea.sln /p:RunAnalyzers=true /warnaserror

Security Scan (Pre-commit)

pre-commit run gitleaks --all-files
pre-commit run detect-secrets --all-files

Dependency Check

cd ./dotnet
dotnet list package --vulnerable --include-transitive
dotnet list package --outdated

Full Analysis Suite

# Run from repository root
.agent/skills/code-analyze/scripts/analyze.sh --all

Analysis with Specific Severity

cd ./dotnet
# Errors only
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=false

# Warnings as errors
dotnet build PigeonPea.sln /p:TreatWarningsAsErrors=true

Troubleshooting

No analyzers found: Verify Roslyn analyzers enabled. See references/static-analysis.md.

Too many warnings: Filter by severity or add suppressions. See references/static-analysis.md.

False positives: Use .editorconfig or suppressions. See references/static-analysis.md.

Secrets not detected: Check .gitleaksignore and .secrets.baseline. See references/security-scan.md.

Dependency scan fails: Network issues or package restore needed. See references/dependency-check.md.

Success Indicators

Static Analysis:

Build succeeded.
    0 Warning(s)
    0 Error(s)

Security Scan:

gitleaks................Passed
detect-secrets...........Passed

Dependency Check:

No vulnerable packages found.

Integration

Before commit: Run security scans (gitleaks, detect-secrets) After build: Run static analysis (Roslyn, StyleCop) Regular checks: Run dependency vulnerability checks

CI/CD Integration: Include all analysis in build pipeline, fail on critical issues

Related

• `./dotnet/ARCHITECTURE.md` - Project structure
• `.pre-commit-config.yaml` - Pre-commit hooks
• `.editorconfig` - Code style rules
• `dotnet-build` - Build skill