static analysis agents

clay-good/OpenLore

Agent

How the engineering skills should consume this repo's domain documentation when exploring the codebase.

clay-good/OpenLore

Agent

The skills speak in terms of five canonical triage roles. This file maps those roles to the label strings that actually exist in this repo's issue tracker.

clay-good/OpenLore

Agent

The architecture document MUST reflect the reality of the code, not just the desired target state. An architecture written without reading the code produces a plan that the codebase cannot support.

ThreeMoonsLab/agents-shipgate

Agent

This is the normative protocol for coding agents that use Agents Shipgate as a local governance check before reporting an agent-capability change complete.

ThreeMoonsLab/agents-shipgate

Agent

This page is the compatibility guide for Claude Code skill installation. For the normative agent protocol, use claude-code.md and protocol.md. The canonical Claude Code control command is.

ThreeMoonsLab/agents-shipgate

Agent

This page is the compatibility guide for Codex plugin and skill installation. For the normative agent protocol, use codex.md and protocol.md. The canonical Codex control command is.

Disentinel/grafema

Agent Claude Code

You are the Grafema QA Agent. Your mission: systematically validate the VS Code extension UI against graph data by driving code-server via Playwright, taking screenshots, and cross-validating every panel with MCP/CLI queries.

advanced-security/codeql-development-mcp-server

Agent

An agent that creates CodeQL query development workshops from production queries using the QL MCP Server tools. Use this agent to generate guided learning materials that teach developers how to build CodeQL queries incrementally.

advanced-security/codeql-development-mcp-server

Agent

An agent for developing new tools and/or improving existing tools for the QL MCP Server.

advanced-security/codeql-development-mcp-server

Agent

An agent for testing and validating tools for the latest QL Development MCP Server.

ncoevoet/claude-review-all

Agent

Scan changed code for logic bugs, security vulnerabilities (OWASP Top 10), completeness gaps, and error handling issues.

ncoevoet/claude-review-all

Agent

Shared severity tiers, verification gate, quotas, and auto-drop rules included by every review-all agent prompt.

ncoevoet/claude-review-all

Agent

Batch-verify all findings from one source agent — re-read source, apply false-positive filter, score each 0-100. One verifier per source agent (not per finding).

panbanda/omen

Agent

Analyzes hotspot data to identify high-risk files where complexity meets frequent changes.

panbanda/omen

Agent

Analyzes self-admitted technical debt markers (TODO, FIXME, HACK) to prioritize cleanup.

panbanda/omen

Agent

Analyzes architectural smells to identify structural issues like cyclic dependencies, hub modules, and instability.

serpentine-parser/serpentine

Agent

Install the Serpentine skill and wire structural orientation into every Claude Code session.

serpentine-parser/serpentine

Agent

Add Serpentine instructions to your Codex project context via AGENTS.md.

serpentine-parser/serpentine

Agent

How Serpentine's structured CLI output gives AI coding agents precise structural context before they read a single file.

Diplomat-ai/diplomat-agent

Agent

Reviews Python code for unguarded AI agent tool calls — database writes, API calls, payments, emails, shell commands — that have no validation, rate limiting, or confirmation. Use this when reviewing agent code, after accepting Copilot suggestions, or before committing changes.

ReviewToolkits/cpython-security-toolkit

Agent

Detects file-loading paths that bypass sys.audit() hooks by using open() instead of io.opencode(), and shell-calling paths where validation occurs before template substitution. Invoke when scanning importlib, webbrowser, or venv.

ReviewToolkits/cpython-security-toolkit

Agent

Detects decompression paths that materialize unbounded output before applying a size check, and allocations whose size is directly controlled by attacker-supplied archive metadata. Invoke when scanning zipfile, tarfile, lzma, bz2, gzip, or plistlib.

ReviewToolkits/cpython-security-toolkit

Agent

Analyzes CPython security fix commits and checks whether the fix was applied to all code paths through the same invariant. The most important agent for preventing second-round CVEs. Invoke after identifying a security fix commit or when reviewing recent type-security labeled changes.

rosselps/whyguard

Agent

Review and implement WhyGuard while preserving historical behavior and evidence traceability.