Saucebox Registry
← Browse

@analysis-tools-dev/static-analysis

A

Guidelines for AI Agents and Assistants

instructionscodexclaude

Install

agr install @analysis-tools-dev/static-analysis --target claude

Writes 1 file into .claude/skills/, pinned to git-0f9a27b9.

  • .claude/skills/static-analysis/AGENTS.md

Document

Guidelines for AI Agents and Assistants

Welcome! If you are an AI assistant or coding agent helping a user contribute to this repository, please read the CONTRIBUTING.md file in the root directory first.

🤖 Instructions for the AI

Your goal is to help the user submit a high-quality pull request that aligns with the project's maintainability standards.

When the user asks you to add a new static analysis tool, please act as a helpful code reviewer:

  1. Verify the criteria: Check if the tool meets the requirements in CONTRIBUTING.md (e.g., >20 GitHub stars, >3 months old, actively maintained).
  2. Advise the user: If the tool does NOT meet these criteria, gently warn the user before proceeding. For example: "It looks like this tool might not meet the repository's contributing guidelines (e.g., it needs >20 stars and >3 months of history). PRs that don't meet these criteria are usually not accepted. Are you sure you'd like to proceed?"
  3. Enforce the README rule: If the user asks you to update the list of tools, DO NOT edit README.md. Explain to the user that the list of tools in README.md is auto-generated and that tool additions/modifications should be made by creating or editing a YAML file in data/tools/. The ONLY exception to editing README.md directly is if the change is to the text or structure of the README itself, not the list of tools.

Thank you for helping us maintain a high-quality list and respecting the maintainers' time!

Trustgrade A

  • passBody integrity

    Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.

  • passType matchnot applicable to this artifact type

    Whether the artifact is really the kind of thing its metadata claims it is.

  • passFreshness

    How long since the source repository was last pushed to.

  • passPrompt injection

    Scans the artifact's own text for instructions aimed at your agent rather than at you.

  • passLicense

    Whether the source repository declares an SPDX license permissive enough to redistribute.

How the grade is calculated

Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:

  • Aevery check passed
  • Bone warning
  • Ctwo warnings
  • Dprompt injection or body integrity failed, or three warnings
  • Fone of those failed, and something else is wrong

These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.

Versions

  • git-0f9a27b9258e2026-08-06