Automated summary
Runs analyzers on a .NET codebase to surface unused NuGet packages, Roslyn code-quality warnings, and known security vulnerabilities.
Strengths
- Three targeted analyzers (packages, quality, security) that can run individually or all at once
- Automatically restores dotnet tools when they are missing before execution
- Produces a structured report with issue counts per category and actionable recommendations
- Keeps logic thin by delegating to existing shell scripts instead of reimplementing analysis
Limitations
- Tightly bound to the .NET/NuGet ecosystem and unusable on other stacks
- Assumes the ./tools/analyzers/*.sh scripts and dotnet-unused are already present in the repo
- Fixes nothing automatically; it only reports and recommends
Use it for a quick, standardized audit of a .NET project before a release or a dependency review.
Avoid it on non-.NET projects or in repos that lack the analyzer scripts and configured dotnet tools.
Security analysis
CautionThe skill uses Bash to run shell scripts and dotnet tooling for code analysis. These are legitimate purposes, but the execution of arbitrary repository scripts and network-based tool restoration warrants caution.
- •Executes repository shell scripts (./tools/analyzers/*.sh) with Bash; if the repository is untrusted or compromised, these scripts could perform arbitrary actions.
- •Runs 'dotnet tool restore' which may download and install tools from the network, introducing supply-chain risk.
Examples
/analyze/analyze security/analyze packagesname: analyze description: Run code analyzers (unused packages, code quality, security). Use when user wants to analyze the codebase or runs /analyze. allowed-tools: Bash, Read
Code Analyzer
Run analysis tools on the codebase.
Usage
/analyze # Run all analyzers
/analyze packages # Unused NuGet packages only
/analyze quality # Code quality only
/analyze security # Security vulnerabilities only
Arguments
$ARGUMENTS- Analyzer type to run- Empty or
all- Run all analyzers packages- Detect unused NuGet packages (dotnet-unused)quality- Check code style and Roslyn warningssecurity- Scan for known CVEs and deprecated packages
- Empty or
Process
Step 1: Ensure Tools Are Installed
Run dotnet tool restore if tools are not available.
Step 2: Execute Analyzer(s)
Based on $ARGUMENTS:
| Argument | Script |
|----------|--------|
| (empty) / all | ./tools/analyzers/run-all.sh |
| packages | ./tools/analyzers/unused-packages/analyze.sh |
| quality | ./tools/analyzers/code-quality/analyze.sh |
| security | ./tools/analyzers/security/analyze.sh |
Step 3: Report Results
Summarize findings:
- Number of issues found per category
- Actionable recommendations
Output Format
=== Analysis Results ===
Unused Packages: X issues
- ProjectName: PackageName
Code Quality: X warnings
- File:Line - Warning description
Security: X vulnerabilities
- PackageName - CVE-XXXX-XXXXX (severity)
Recommendations:
1. Remove unused package X from project Y
2. Fix warning Z in file W
From the file to a first result
The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.
View the source and supporting filesThis download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.
1. Download the file
Download SKILL.mdFrom the root of a test project, save the file as .skill-downloads/code-analyzer-mmh8qqwd/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.
Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.
mkdir -p '.skill-downloads/code-analyzer-mmh8qqwd' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/code-analyzer-mmh8qqwd/download' --output '.skill-downloads/code-analyzer-mmh8qqwd/SKILL.md.part' && mv '.skill-downloads/code-analyzer-mmh8qqwd/SKILL.md.part' '.skill-downloads/code-analyzer-mmh8qqwd/SKILL.md'2. Check prerequisites
Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.
Tools declared by the author (check availability in your agent): Bash, Read
No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.
The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.
3. Load the skill
After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.
Claude Code
test -f '.skill-downloads/code-analyzer-mmh8qqwd/SKILL.md' && test -s '.skill-downloads/code-analyzer-mmh8qqwd/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/analyze' && cp -R '.skill-downloads/code-analyzer-mmh8qqwd' '.claude/skills/analyze'OpenSkills
OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.
Official OpenSkills installationopenskills install './.skill-downloads/code-analyzer-mmh8qqwd'openskills read 'code-analyzer-mmh8qqwd'Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.
For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.
openskills syncManual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.
4. Try a first task
Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:
Read .skill-downloads/code-analyzer-mmh8qqwd/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.
React Hook Form Best Practices
Development
Master React Hook Form: avoid anti-patterns, manage subscriptions, and handle reset, dirty state, and controlled inputs correctly.
Emotion to Mantine Migration
Development
Migrate Emotion styled-components to Mantine components with style props and CSS modules. Use when converting .styled.tsx files or removing @emotion imports.
Scope Creep Detector
Development
Analyzes git diffs against a stated intent to detect scope creep, unrelated files, broad PRs, and oversized changes, then suggests keep, split, or justify actions.