Development · Static analysis and SAST

Turns natural-language code queries into ast-grep rules for structural search, testing each rule against an example file before running it on a codebase.

warp-drive-data/warp-drive

Searches and rewrites code by syntax-tree shape across 25 languages with ast-grep, for codemods, structural queries and YAML lint rules, using a Python wrapper script.

code-yeongyu/oh-my-openagent

A skill your agent uses when biome migrate eslint must preserve configurable ESLint rule options through source-option models, Biome conversions, typed rule variants, and migration fixtures.

biomejs/biome

Compares Trailmark code graphs at two snapshots, such as commits, tags or directories, to surface attack paths, blast radius and taint changes that text diffs miss.

trailofbits/skills

Sets the sonar-java conventions for adding an analyzer rule: metadata from rule-api, test locations, MethodMatchers and what not to commit or change.

SonarSource/sonar-java

Run, interpret, or modify Skylos safely. An agent skill from duriantaco/skylos.

duriantaco/skylos

Investigate and harden Skylos security behavior. An agent skill from duriantaco/skylos.

duriantaco/skylos

Code review for the current change, before it is pushed. An agent skill from openqodex/openqodex.

openqodex/openqodex

Gives an agent working in a Go codebase a structural view through a local MCP server: call graphs, blast-radius and impact analysis, and bounded first-call exploration.

ozgurcd/gograph

Builds a local architecture wiki for a repository from the CodexQA symbol graph (no model needed): modules, who calls whom and how often, reading paths, and one self-contained HTML page.

openqa-cn/codexqa

GitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release…

samber/cc-skills-golang

Finds duplicated code in 220+ languages with jscpd, reports exact, renamed and near-miss clones in a compact agent-friendly format and measures duplication.

kucherenko/jscpd

Explains what each aru doctor architecture-check finding means in the Arandu Go framework, why it is never suppressed, and how to fix the line it points to.

arandu-io/arandu

CI/CD with GitHub Actions for Golang — testing, linting, SAST, security scanning, coverage, Dependabot, Renovate, GoReleaser, release pipelines.

context-labs/whip

Diagnoses exception root causes from stack traces, logs, call-chain dumps, and debug output using the CodexQA CLI for structured repo analysis.

openqa-cn/codexqa

Answers call-graph questions that combine several conditions, such as complex functions that reach a target or untested symbols near main, using ripwire's graph-query mode.

redhat-et/ripwire

Codebase intelligence for TypeScript and JavaScript. An agent skill from fallow-rs/fallow-skills.

fallow-rs/fallow-skills

Diagnose and fix Session Sniffer bugs, errors, tracebacks, logs, lint failures, static-analysis findings, test failures, and IDE-reported problems.

BUZZARDGTA/Session-Sniffer

Finds sensitive data that C, C++ or Rust code never wipes from memory, including wipes the compiler optimizes away, using source, assembly and control-flow analysis.

trailofbits/skills

Guide to running, reading and fixing code style and analysis violations in grails-core with CodeNarc, Checkstyle, PMD, SpotBugs, Spotless and JaCoCo through Gradle.

apache/grails-core

Audit a named AI agent config, system prompt, tool-definition or instruction file (YAML, JSON, Markdown, text, or Python) with the released LintLang CLI, on request.

hermes-labs-ai/lintlang

Master ShellCheck static analysis configuration and usage for shell script quality. Use when setting up linting infrastructure, fixing code issues…

wshobson/agents

The Massing release discipline — how to ship a verified, CI-green version-numbered release direct to main.

ibuilder/massing

Scans a Power Pages site project for security issues in source code and dependencies.

microsoft/power-platform-skills

Run convex-doctor static analysis, interpret findings, and fix issues across security, performance, correctness, schema, and architecture categories.

waynesutton/markdown-site

Runs linting and static analysis on PHP/CSS/JS using phpcs, phpstan, and rector.

bonny/WordPress-Simple-History

Reduce technical debt and improve code quality by systematically resolving static analysis warnings.

flutter/flutter-intellij

Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.

affaan-m/ECC

Create batched Dependabot-style pull requests for GitHub security findings in axelixlabs/axelix, grouped by dependency surface such as master/front-end, master/build.gradle.kts, or starter Gradle…

axelixlabs/axelix

Methodology for root-causing hard concurrency / memory-ordering bugs (intermittent races, use-after-free, RCU/lock-free publish-order defects, "impossible" stale reads) with LTTng flight-recorder…

isc-projects/bind9

Fix open Dependabot and CodeQL/code-scanning alerts directly on the current branch.

cloudposse/atmos

Review code for refactorability — surface concrete, prioritized refactoring opportunities grounded in Martin Fowler's smell catalog and SOLID, augmented with static analysis tools (gocyclo…

meain/dotfiles

Writes strictly typed modern PHP 8.3+ for Laravel, Symfony and plain projects, with PHPStan level 9, PHPUnit or Pest tests, typed DTOs and secure defaults.

Jeffallan/claude-skills

Builds a code graph of functions, classes and calls across languages, then queries it for call paths, taint, blast radius, entry points and complexity hotspots.

trailofbits/skills

Get a path in the call graph from a source function to a specified destination function in the codebase.

opensage-agent/opensage-adk

Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability.

AratKruglik/claude-laravel

GitHub repository automation (CI/CD, issue templates, Dependabot, CodeQL).

secondsky/claude-skills

Graph-evidence AI code review (codexqa-code-reviewer) for ANY language repo using ONLY the CodexQA CLI symbol graph (call chains, classes, methods, configs, blast radius, test edges), then an…

openqa-cn/codexqa

Queries a local CodexQA symbol graph for change review, regression scope, test gaps, error location, and entry risk.

openqa-cn/codexqa

Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification.

aftermathlabs/llvm-msvc

Run static analysis on Common Lisp projects with the Mallet command-line linter.

ultralisp/ultralisp

Automatic quality control, linting, and static analysis procedures.

xenitV1/Antigravity-Workflows

Run and fix the repository static analysis suite. An agent skill from ethereum/execution-specs.

ethereum/execution-specs

A skill your agent uses when scanning source code for bugs, anti-patterns, code smells, or quality issues in a codebase, or when running a proof-driven bug hunt that must find, prove, fix, and…

WrongStack/WrongStack

Standardized compiler diagnostics, static analysis lints, and automated IDE quick-fixes.

rodydavis/signals.dart

Automated code review and security linting integration for CI/CD pipelines using reviewdog.

AgentSecOps/SecOpsAgentKit

Scan C source files for hard-to-test static dependencies — DateTime.Now/UtcNow, File., Directory., Environment., HttpClient, Console., Process., and other untestable statics.

microsoft/testfx

You are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices.

aiskillstore/marketplace