dx-code-analyzer-run
installsforks
How to install dx-code-analyzer-run?
forcedotcom/sf-skills/dx-code-analyzer-run
$npx -y skills add forcedotcom/sf-skills --skill dx-code-analyzer-runRun Salesforce Code Analyzer to scan code for security, performance, best practice, and code style violations. Supports all engines (PMD, ESLint, CPD, RetireJS, Flow, SFGE, ApexGuru), targets (files, folders, git diff), categories, and severities. Also handles post-scan explorati
SKILL.md
| 1 | # Running Code Analyzer Skill |
| 2 | |
| 3 | ## CRITICAL: Mandatory Script Usage |
| 4 | |
| 5 | Every interaction with Code Analyzer results MUST go through the bundled scripts in `<skill_dir>/scripts/`. No exceptions. |
| 6 | |
| 7 | ### WRONG — never do this: |
| 8 | |
| 9 | ```bash |
| 10 | # WRONG: inline Python to parse results |
| 11 | python3 -c "import json; data = json.load(open('results.json'))..." |
| 12 | |
| 13 | # WRONG: inline Node.js to parse results |
| 14 | node -e "const data = require('./results.json')..." |
| 15 | |
| 16 | # WRONG: jq to filter results |
| 17 | cat results.json | jq '.violations[] | select(.engine=="pmd")' |
| 18 | |
| 19 | # WRONG: reading the results file directly (it can be 10MB+) |
| 20 | Read tool → code-analyzer-results-*.json |
| 21 | ``` |
| 22 | |
| 23 | Also forbidden: `run_code_analyzer` and any `mcp__*` tool — Bash only. |
| 24 | |
| 25 | ### RIGHT — always do this: |
| 26 | |
| 27 | ```bash |
| 28 | # Summarize scan results |
| 29 | node "<skill_dir>/scripts/parse-results.js" "./code-analyzer-results-TIMESTAMP.json" |
| 30 | |
| 31 | # Filter/rank/query results (by engine, severity, file, rule, category) |
| 32 | node "<skill_dir>/scripts/query-results.js" "./code-analyzer-results-TIMESTAMP.json" --engine pmd --summary |
| 33 | |
| 34 | # List/browse available rules (by engine, category, language, severity) |
| 35 | node "<skill_dir>/scripts/list-rules.js" "Security" --top 10 |
| 36 | |
| 37 | # Look up what a rule means |
| 38 | node "<skill_dir>/scripts/describe-rule.js" "ApexCRUDViolation" --engine pmd |
| 39 | |
| 40 | # Discover fixable violations |
| 41 | node "<skill_dir>/scripts/discover-fixes.js" "./code-analyzer-results-TIMESTAMP.json" |
| 42 | |
| 43 | # Apply fixes (after user confirms) |
| 44 | node "<skill_dir>/scripts/apply-fixes.js" "./code-analyzer-results-TIMESTAMP.json" |
| 45 | |
| 46 | # Summarize applied fixes |
| 47 | node "<skill_dir>/scripts/summarize-fixes.js" "./code-analyzer-results-TIMESTAMP.json" |
| 48 | |
| 49 | # Filter vendor files (jQuery, Bootstrap, *.min.js) before applying fixes |
| 50 | node "<skill_dir>/scripts/filter-violations.js" "./code-analyzer-results-TIMESTAMP.json" "./code-analyzer-results-TIMESTAMP-filtered.json" --report |
| 51 | ``` |
| 52 | |
| 53 | `<skill_dir>` is the absolute path to the directory containing this SKILL.md. **Never** use `./scripts/` — that resolves against the user's CWD, not the skill dir. |
| 54 | |
| 55 | Any aggregation, filter, or rank question ("which file has the most violations?", "how many PMD issues?", "top rules by count", "break down by severity") is answered by `query-results.js` — its output already includes `topRules`, `topFiles`, and `severityCounts`. |
| 56 | |
| 57 | --- |
| 58 | |
| 59 | ## Overview |
| 60 | |
| 61 | > **Ecosystem:** This skill is part of a 3-skill Code Analyzer suite — `dx-code-analyzer-run` (scans & results) · `dx-code-analyzer-configure` (setup, config, CI/CD) · `dx-code-analyzer-custom-rule-create` (custom rule authoring). |
| 62 | |
| 63 | This skill translates natural-language requests ("scan for security issues", "check my changes") into the correct `sf code-analyzer run` command, executes scans across any combination of engines/targets/severities, and presents actionable results. When engine-provided fixes are available, it discovers them, asks for user confirmation, applies them safely, and offers verification. Use it for static analysis, security reviews, AppExchange certification, code-quality checks, and finding duplicates/vulnerabilities in Salesforce projects. |
| 64 | |
| 65 | **In scope:** running scans, parsing/filtering/ranking results, applying engine auto-fixes, diff-based scans, all output formats (JSON/HTML/SARIF/CSV/XML), describing/listing rules, scan-failure troubleshooting. |
| 66 | |
| 67 | **Out of scope:** installing/configuring `sf` or the plugin (→ `dx-code-analyzer-configure`), writing custom rules/engines (→ `dx-code-analyzer-custom-rule-create`), AI-generated fixes beyond engine-provided ones, deep refactoring, CI/CD setup (→ `dx-code-analyzer-configure`). |
| 68 | |
| 69 | **Allowed tools:** Bash (`sf code-analyzer`, `node`, `git diff`, `date`), Read, Write, Edit. **Forbidden:** any MCP |
People who liked this also viewed
6 picksType
- azure-diagnosticsDebug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deploySkillsJul 2026
- systematic-debuggingUse when encountering any bug, test failure, or unexpected behavior, before proposing fixesSkillsJul 2026
- safe-debugRigor Debug / Rigor Audit skill for deep learning research work. Use when the user pastes a traceback, terminal error, CUDA OOM, checkpoint load failure, shape mismatch, NaN loss symptom, or training SkillsMay 2026
- explore-runRigor Improve / Rigor Explore run leaf skill for bounded exploratory evidence in deep learning research repositories. Use when the researcher explicitly authorizes exploratory runs such as small-subseSkillsMay 2026
- minimal-run-and-auditRigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation SkillsMay 2026
- insforge-debugUse when diagnosing problems in an InsForge project — reactive failures (SDK error object, HTTP 4xx/5xx, gateway timeout 502/503/504, edge function failure or timeout, login/OAuth/auth errors, RLS denSkillsJul 2026
