Security audit workflow - vulnerability scan β verification
npx skills add managedcode/dotnet-skills --skill "dotnet-meziantou-analyzer"
Install specific skill from multi-skill repository
# Description
Use the open-source free `Meziantou.Analyzer` package for design, usage, security, performance, and style rules in .NET. Use when a repo wants broader analyzer coverage with a single NuGet package.
# SKILL.md
name: dotnet-meziantou-analyzer
version: "1.0.0"
category: "Code Quality"
description: "Use the open-source free Meziantou.Analyzer package for design, usage, security, performance, and style rules in .NET. Use when a repo wants broader analyzer coverage with a single NuGet package."
compatibility: "Requires a .NET SDK-based repository; respects the repo's AGENTS.md commands first."
Meziantou.Analyzer
Trigger On
- the repo uses or wants
Meziantou.Analyzer - the team wants one analyzer pack that covers design, usage, security, performance, and style
Value
- produce a concrete project delta: code, docs, config, tests, CI, or review artifact
- reduce ambiguity through explicit planning, verification, and final validation skills
- leave reusable project context so future tasks are faster and safer
Do Not Use For
- repos that already enforce an overlapping analyzer baseline and do not want extra diagnostics
- formatting-only work
Inputs
- the nearest
AGENTS.md - current analyzer packages
.editorconfig
Quick Start
- Read the nearest
AGENTS.mdand confirm scope and constraints. - Run this skill's
Workflowthrough theRalph Loopuntil outcomes are acceptable. - Return the
Required Result Formatwith concrete artifacts and verification evidence.
Workflow
- Add
Meziantou.Analyzerwhen the repo wants broader rules than the SDK baseline. - Keep rule severity in the repo-root
.editorconfig. - Review overlaps with SDK analyzers and Roslynator before mass-enabling everything as errors.
Bootstrap When Missing
If Meziantou.Analyzer is not configured yet:
- Detect current state:
rg -n "Meziantou\\.Analyzer" -g '*.csproj' .- Add the package to the intended scope (project-level or shared props strategy):
dotnet add PROJECT.csproj package Meziantou.Analyzer- Set severity in root
.editorconfigfor the enabledMAxxxxrules. - Keep overlap with SDK analyzers and Roslynator explicit to avoid duplicate noise.
- Run
dotnet build SOLUTION_OR_PROJECTand returnstatus: configuredorstatus: improved. - If the repo intentionally keeps a smaller analyzer surface, return
status: not_applicable.
Deliver
- explicit Meziantou package setup
- repo-owned severity and warning policy
Validate
- the added rules are understood by the team
- CI runs stay actionable instead of noisy
Ralph Loop
Use the Ralph Loop for every task, including docs, architecture, testing, and tooling work.
- Plan first (mandatory):
- analyze current state
- define target outcome, constraints, and risks
- write a detailed execution plan
- list final validation skills to run at the end, with order and reason
- Execute one planned step and produce a concrete delta.
- Review the result and capture findings with actionable next fixes.
- Apply fixes in small batches and rerun the relevant checks or review steps.
- Update the plan after each iteration.
- Repeat until outcomes are acceptable or only explicit exceptions remain.
- If a dependency is missing, bootstrap it or return
status: not_applicablewith explicit reason and fallback path.
Required Result Format
status:complete|clean|improved|configured|not_applicable|blockedplan: concise plan and current iteration stepactions_taken: concrete changes madevalidation_skills: final skills run, or skipped with reasonsverification: commands, checks, or review evidence summaryremaining: top unresolved items ornone
For setup-only requests with no execution, return status: configured and exact next commands.
Load References
- read
references/meziantou-analyzer.mdfirst - read
references/rules.mdfor commonly used rules and their categories - read
references/config.mdfor .editorconfig configuration patterns
Example Requests
- "Add Meziantou analyzers to the repo."
- "Use Meziantou for extra quality and security checks."
# Supported AI Coding Agents
This skill is compatible with the SKILL.md standard and works with all major AI coding agents:
Learn more about the SKILL.md standard and how to use these skills with your preferred AI coding agent.