Borrowing it
Nothing to install: this file belongs to managedcode/Orleans.RateLimiting. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/managedcode/Orleans.RateLimiting/main/.codex/skills/code-analysis/SKILL.mdgit clone --depth 1 https://github.com/managedcode/Orleans.RateLimitingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/managedcode/orleans.ratelimiting/code-analysis)<a href="https://agentmods.dev/skills/managedcode/orleans.ratelimiting/code-analysis"><img src="https://agentmods.dev/badge/skills/managedcode/orleans.ratelimiting/code-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/managedcode/orleans.ratelimiting/code-analysis"><img src="https://agentmods.dev/badge/skills/managedcode/orleans.ratelimiting/code-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.01886 |
| Opus 5.5 | $0.00022 | $0.00754 |
| Sonnet 5.5 | $0.00011 | $0.00377 |
| Haiku 4.5 | $0.00006 | $0.00189 |
Grade A, and why
code-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
92% identical to code-analysis — 12 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.
.NET Code Analysis
Trigger On
- the repo wants first-party .NET analyzers
- CI should fail on analyzer warnings
- the team needs
AnalysisLevelorAnalysisModeguidance - the repo needs a gradual Roslyn warning promotion strategy
Do Not Use For
- third-party analyzer selection by itself
- formatting-only work
Inputs
- the nearest
AGENTS.md - project files or
Directory.Build.props - current analyzer severity policy
Hard Rules for AI Agents
Non-negotiable. Violating these undermines the user's explicit intent.
- Never disable or remove
TreatWarningsAsErrorsorWarningsAsErrorsif the project has set them. Do not comment them out, set tofalse, wrap in a condition, or add<TreatWarningsAsErrors>false</TreatWarningsAsErrors>to make the build pass. - Never add
<NoWarn>or#pragma warning disablefor warnings the user chose to treat as errors, unless the user explicitly approves the suppression. - Never silently downgrade severity in
.editorconfig(e.g.errortowarningornone) to make a build succeed. - If warnings-as-errors breaks the build — fix the code. If the fix is too large, ask the user whether to defer that warning ID.
- If warning volume is too large to fix in one pass — report count and categories to the user and ask which to tackle first. Do not unilaterally disable the policy.
Workflow
flowchart TD
A[Start] --> B{New or legacy project?}
B -->|New| C[TreatWarningsAsErrors=true immediately]
B -->|Legacy| D[dotnet build, count warnings by ID]
D --> E{"< 30 warnings?"}
E -->|Yes| F[Fix all, then enable TreatWarningsAsErrors]
E -->|No| G[Report counts to user, ask which batch first]
G --> H[Add selected IDs to WarningsAsErrors]
H --> I[Fix that batch, verify build]
I --> J{More batches?}
J -->|Yes| G
J -->|No| F
C --> K[Set AnalysisLevel latest-recommended]
F --> K
K --> L[Promote security CA3xxx/CA5xxx to error in .editorconfig]
L --> M[Validate: build + CI green]
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 19d ago First seen · 192 lines · 56 tokens per session scan A 36df9b70ee5a
code-analysis is a skill published in the GitHub repository managedcode/Orleans.RateLimiting (30 stars, last pushed 11d ago), licensed MIT. It adds 56 tokens to every session and 1,886 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 92% identical to code-analysis, differing in 12 lines, and is treated as a copy.
Other skills, from other repositories
profiling
Use the free official .NET diagnostics CLI tools for profiling and runtime investigation in .NET repositories. USE FOR: the repo needs performance or runtime profiling for a .NET application; the user asks about slow code, high CPU, GC pressure, allocation growth, exception storms, lock. DO NOT USE FOR: replacing…
roslyn-codelens
Use when working with any .NET / C# code (.cs/.csproj/.sln/.slnx files), finding callers/references/implementations, checking compiler errors or warnings, running dotnet build for diagnostics, searching for a type/method/interface by name, inspecting DI registrations, detecting dead code or circular dependencies…
cs0618-hunter
Detects and fixes CS0618 obsolete API warnings in .NET builds. The compiler is the authoritative source for what your project actually triggers — it catches transitive obsoletions, overload-resolution surprises, and project-local [Obsolete] attributes that static inspection cannot see. Pair with the repository-pinned…
nuget-diff-analyzer
Post-processes the repository-pinned [email protected] -- diff output into a categorised report (breaking / additive / newly-obsolete) with each finding cross-referenced to the MAF obsolete-API registry.
rider-search
Routing rules for code search in JetBrains Rider projects — use the Rider MCP symbol/reference/file tools instead of Bash grep. Use whenever searching for a symbol, definition, function, variable, type, or finding usages/references in a C#/.NET or Unreal C++ codebase open in Rider.
dotnet-performance
Evidence-first performance engineering workflow for coding agents combining portable .NET diagnostics with platform-native profiling, BenchmarkDotNet, application benchmarking, statistical validation, deployment, container, graphics, and GPU procedures.