本文へ移動
cccskills
無料GitHub で公開

codeql

Use the open-source CodeQL ecosystem for .NET security analysis. Use when a repo needs CodeQL query packs, CLI-based analysis on open source codebases, or GitHub Action setup with explicit licensing caveats. USE FOR: the repo uses or wants CodeQL for .NET security analysis; GitHub code scanning is part of the CI plan. DO NOT USE FOR: teams that need a tool with no private-repo licensing caveat. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.

managedcode/dotnet-skills
インストール方法を見る

含まれるファイル（5）

  • SKILL.md4.2 KB
  • manifest.json50 B
  • references/codeql.md1.4 KB
  • references/queries.md5.2 KB
  • references/workflow.md6.3 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

CodeQL for .NET

Trigger On

  • the repo uses or wants CodeQL for .NET security analysis
  • GitHub code scanning is part of the CI plan

Value

  • produce a concrete project delta: code, docs, config, tests, CI, or review artifact
  • reduce ambiguity through explicit planning, verification, and final validation skills
  • leave reusable project context so future tasks are faster and safer

Do Not Use For

  • teams that need a tool with no private-repo licensing caveat

Inputs

  • the nearest AGENTS.md
  • hosting model: open-source repo, private repo, or manual CLI workflow
  • current GitHub Actions workflow

Quick Start

  1. Read the nearest AGENTS.md and confirm scope and constraints.
  2. Run this skill's Workflow through the Ralph Loop until outcomes are acceptable.
  3. Return the Required Result Format with concrete artifacts and verification evidence.

Workflow

  1. Treat CodeQL as a security-analysis tool, not as a style checker.
  2. Make the licensing and hosting model explicit before proposing it as the default gate.
  3. Prefer manual build mode for compiled .NET projects when precision matters.

Bootstrap When Missing

If CodeQL is not configured yet:

  1. Detect current state:
    • rg -n "codeql-action|security-events|CodeQL" .github/workflows
    • command -v codeql
  2. Prefer CI-first setup for repository scanning using github/codeql-action/init and github/codeql-action/analyze.
  3. Configure explicit .NET build mode in workflow (manual when precision matters).
  4. Add local CLI usage only when the task requires local query work.
  5. Run the workflow or local analyze path and return status: configured or status: improved.
  6. If licensing or hosting constraints reject CodeQL for this repo, return status: not_applicable with caveat documented.

Deliver

  • explicit CodeQL setup or an explicit rejection with caveat documented
  • reproducible CI or local commands for running CodeQL in this repo

Validate

  • the chosen CodeQL path is allowed for the repo type
  • build mode is documented and reproducible

Ralph Loop

Use the Ralph Loop for every task, including docs, architecture, testing, and tooling work.

  1. Plan first (mandatory):
    • analyze current state
    • define target outcome, constraints, and risks
    • write a detailed execution plan
    • list final validation skills to run at the end, with order and reason
  2. Execute one planned step and produce a concrete delta.
  3. Review the result and capture findings with actionable next fixes.
  4. Apply fixes in small batches and rerun the relevant checks or review steps.
  5. Update the plan after each iteration.
  6. Repeat until outcomes are acceptable or only explicit exceptions remain.
  7. If a dependency is missing, bootstrap it or return status: not_applicable with explicit reason and fallback path.

Required Result Format

  • status: complete | clean | improved | configured | not_applicable | blocked
  • plan: concise plan and current iteration step
  • actions_taken: concrete changes made
  • validation_skills: final skills run, or skipped with reasons
  • verification: commands, checks, or review evidence summary
  • remaining: top unresolved items or none

For setup-only requests with no execution, return status: configured and exact next commands.

Load References

Example Requests

  • "Set up CodeQL for this public .NET repo."
  • "Explain the CodeQL caveat for private repos."

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

agentic-workflows

無料

Route gh-aw workflow design/create/debug/upgrade requests to the right prompts.

日本語の概要は準備中です。原文の説明を表示しています。

managedcode/dotnet-skills4852026年10月10日 更新

analyzer-config

無料

Use a repo-root `.editorconfig` to configure free .NET analyzer and style rules. Use when a .NET repo needs rule severity, code-style options, section layout, or analyzer ownership made explicit. USE FOR: the repo needs a root .editorconfig; analyzer severity and style ownership are unclear; the team wants one source of truth for rule configuration. DO NOT USE FOR: choosing analyzers with no config change; formatting-only execution with no config ownership question. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.

日本語の概要は準備中です。原文の説明を表示しています。

managedcode/dotnet-skills4852026年10月10日 更新

analyzing-dotnet-performance

無料

Scans .NET code for ~50 performance anti-patterns across async, memory, strings, collections, LINQ, regex, serialization, and I/O with tiered severity classification. Use when analyzing .NET code for optimization opportunities, reviewing hot paths, or auditing allocation-heavy patterns.

日本語の概要は準備中です。原文の説明を表示しています。

managedcode/dotnet-skills4852026年10月10日 更新

android-tombstone-symbolication

無料

Symbolicate the .NET runtime frames in an Android tombstone file. Extracts BuildIds and PC offsets from the native backtrace, downloads debug symbols from the Microsoft symbol server, and runs llvm-symbolizer to produce function names with source file and line numbers. USE FOR triaging a .NET MAUI or Mono Android app crash from a tombstone, resolving native backtrace frames in libmonosgen-2.0.so or libcoreclr.so to .NET runtime source code, or investigating SIGABRT, SIGSEGV, or other native signals originating from the .NET runtime on Android. DO NOT USE FOR pure Java/Kotlin crashes, managed .NET exceptions that are already captured in logcat, or iOS crash logs. INVOKES Symbolicate-Tombstone.ps1 script, llvm-symbolizer, Microsoft symbol server.

日本語の概要は準備中です。原文の説明を表示しています。

managedcode/dotnet-skills4852026年10月10日 更新

apple-crash-symbolication

無料

Symbolicate .NET runtime frames in Apple platform .ips crash logs (iOS, tvOS, Mac Catalyst, macOS). Extracts UUIDs and addresses from the native backtrace, locates dSYM debug symbols, and runs atos to produce function names with source file and line numbers. Automatically downloads .dwarf symbols from the Microsoft symbol server using Mach-O UUIDs. USE FOR triaging a .NET MAUI or Mono app crash from an .ips file on any Apple platform, resolving native backtrace frames in libcoreclr or libmonosgen-2.0 to .NET runtime source code, retrieving .ips crash logs from a connected iOS device or iPhone, or investigating EXC_CRASH, EXC_BAD_ACCESS, SIGABRT, or SIGSEGV originating from the .NET runtime. DO NOT USE FOR pure Swift/Objective-C crashes with no .NET components, or Android tombstone files. INVOKES Symbolicate-Crash.ps1 script, atos, dwarfdump, idevicecrashreport.

日本語の概要は準備中です。原文の説明を表示しています。

managedcode/dotnet-skills4852026年10月10日 更新

architecture

無料

Design or review .NET solution architecture across modular monoliths, clean architecture, vertical slices, microservices, DDD, CQRS, and cloud-native boundaries without over-engineering. USE FOR: .NET architecture choices; layer and domain boundary review; service decomposition; clean architecture, vertical slice, DDD, CQRS, and modular monolith decisions. DO NOT USE FOR: unrelated stacks; generic tasks that do not need this specific guidance. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.

日本語の概要は準備中です。原文の説明を表示しています。

managedcode/dotnet-skills4852026年10月10日 更新

managedcode のスキルをすべて見る

このスキルの問題を報告する