Borrowing it
Nothing to install: this file belongs to managedcode/PrompterOne. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/managedcode/PrompterOne/main/.codex/skills/dotnet-sonarjs/SKILL.mdgit clone --depth 1 https://github.com/managedcode/PrompterOneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/managedcode/prompterone/dotnet-sonarjs)<a href="https://agentmods.dev/skills/managedcode/prompterone/dotnet-sonarjs"><img src="https://agentmods.dev/badge/skills/managedcode/prompterone/dotnet-sonarjs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/managedcode/prompterone/dotnet-sonarjs"><img src="https://agentmods.dev/badge/skills/managedcode/prompterone/dotnet-sonarjs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01265 |
| Opus 5.5 | $0.00030 | $0.00506 |
| Sonnet 5.5 | $0.00015 | $0.00253 |
| Haiku 4.5 | $0.00007 | $0.00127 |
Grade A, and why
dotnet-sonarjs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to sonarjs — 9 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SonarJS Rules for Frontend Assets in .NET Repositories
Trigger On
- the repo already uses SonarQube, SonarCloud, or
eslint-plugin-sonarjs - the user asks for frontend code smells, cognitive complexity limits, or deeper bug-risk rules beyond base ESLint
- maintainability and reliability findings on JS or TS code should become a review or CI gate
Do Not Use For
- repos that want only a lightweight base lint setup with no extra smell or complexity rules
- teams that reject SonarQube, SonarCloud, or source-available SonarJS-derived tooling as a default gate
- cases where the problem is runtime page quality rather than source-level maintainability
Inputs
- the nearest
AGENTS.md package.json- existing ESLint config
- any SonarQube, SonarCloud, or scanner config already present in CI
flowchart LR
A["Need Sonar-style checks in a .NET repo frontend"] --> B{"Local developer loop or existing server gate?"}
B -->|Local| C["Install eslint-plugin-sonarjs"]
C --> D["Run through the normal eslint command"]
B -->|Existing SonarQube or SonarCloud gate| E["Keep full analysis in the existing scanner pipeline"]
D --> F["Phase rules and fix code"]
E --> F
Workflow
- Decide the execution path first:
- local developer loop through
eslint-plugin-sonarjs - server-side analysis through an already adopted SonarQube or SonarCloud pipeline
- local developer loop through
- For local work, treat SonarJS as an ESLint extension rather than a standalone CLI.
- Keep the first rollout narrow:
- bug-prone rules
- cognitive complexity
- duplicated branching or suspicious control flow
- Add rules to the existing ESLint command instead of inventing a parallel local lint entrypoint.
- If the repo already has SonarQube or SonarCloud, align local rule expectations with the server gate instead of maintaining two conflicting policies.
- Fix code or phase rules deliberately; do not hide the first rollout behind broad disables.
- Document licensing or hosting caveats before making Sonar-based tooling the default quality gate.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 110 lines · 75 tokens per session scan A 89fc353ac2cb
dotnet-sonarjs is a skill published in the GitHub repository managedcode/PrompterOne (45 stars, last pushed 5mo ago), licensed MIT. It adds 75 tokens to every session and 1,265 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 86% identical to sonarjs, differing in 9 lines, and is treated as a copy.
Other skills, from other repositories
profiling
Use the free official .NET diagnostics CLI tools for profiling and runtime investigation in .NET repositories. USE FOR: the repo needs performance or runtime profiling for a .NET application; the user asks about slow code, high CPU, GC pressure, allocation growth, exception storms, lock. DO NOT USE FOR: replacing…
roslyn-codelens
Use when working with any .NET / C# code (.cs/.csproj/.sln/.slnx files), finding callers/references/implementations, checking compiler errors or warnings, running dotnet build for diagnostics, searching for a type/method/interface by name, inspecting DI registrations, detecting dead code or circular dependencies…
mapsui
Use when embedding interactive 2D maps in .NET desktop (WPF/WinUI/WinForms) or mobile (MAUI/Avalonia/Blazor) apps with Mapsui 5.1.0 (net8.0/net9.0) — Mapsui.Wpf/Mapsui.Maui packages, Map and Layers, OpenStreetMap.CreateTileLayer, Shapefile/GeoJSON via Mapsui.Nts, SphericalMercator.FromLonLat, or fixing a blank…
cs0618-hunter
Detects and fixes CS0618 obsolete API warnings in .NET builds. The compiler is the authoritative source for what your project actually triggers — it catches transitive obsoletions, overload-resolution surprises, and project-local [Obsolete] attributes that static inspection cannot see. Pair with the repository-pinned…
nuget-diff-analyzer
Post-processes the repository-pinned [email protected] -- diff output into a categorised report (breaking / additive / newly-obsolete) with each finding cross-referenced to the MAF obsolete-API registry.
analyzer-development
Create Roslyn-based analyzers and code-fix providers for detecting Web Forms migration patterns. Covers DiagnosticAnalyzer architecture, diagnostic ID conventions (BWFC001–BWFC099), CodeFixProvider authoring, testing with CSharpAnalyzerTest/CSharpCodeFixTest, and the analyzer release tracking files. Use when adding a…