ase-code-analyze

SkillSecurity

Analyze the source code for problems in either the logic and semantics and its related control flow, performance and efficiency, or security.

Available today. Use it from your connected AI after setup.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the ase-code-analyze skill

What this skill tells your AI

The instructions your AI receives, as published by rse/ase in plugin/skills/ase-code-analyze/SKILL.md and read by ahel’s review.

@${CLAUDE_SKILL_DIR}/../../meta/ase-control.md @${CLAUDE_SKILL_DIR}/../../meta/ase-skill.md @${CLAUDE_SKILL_DIR}/../../meta/ase-getopt.md

$ARGUMENTS

  1. Only output the following and then STOP the entire flow (do not perform any further steps):

  2. The project source artifacts are classified as a black box, so the user does not want them inspected or their problems surfaced. Skip the entire investigation and analysis: do not invoke any Glob or Agent tool and do not read any source, only output the following and then SKIP the remaining step STEP 3:

    First, use the following to give a hint on this step:

    Dispatch the investigation to sub-agents via the Agent tool so that no investigation details leak into the user-visible transcript. The sub-agents perform the silent reading and checking; only their final structured return values are consumed here.

    For this, first determine the analysis lens : set performance if is equal true, set security if is equal true, and set logic otherwise.

    Then silently resolve <getopt-arguments/> to the list of individual source code files, expanding any directory or wildcard references with the Glob tool. Then partition , preserving order, into at most eight batches of roughly equal size (a single file yields a single batch), and invoke the following tool once per batch, emitting all invocations in one single message so they run in parallel:

        Agent(
            description:       "Analysis Investigation (<batch-index/>/<batch-count/>)",
            subagent_type:     "ase:ase-code-analyze",
            prompt:            "<lens/> <batch/>",
            run_in_background: false
        )
    

    Here is the space-separated list of the source code file paths of the corresponding batch, is the 1-based index of that batch, and is the total number of batches, so that each parallel invocation is distinguishable in the progress display.

    Parse the result message of each Agent tool invocation as a JSON array and concatenate all those arrays. Then deduplicate the combined list: when two problems share the same file and line, silently drop all but the first one (sub-agents may have read overlapping related files for comprehension). Finally sort the list by file and then numerically by line, and set to that list.

    You MUST NOT output anything at all in this STEP 2 beyond the Glob and Agent tool invocations.

  3. Before reporting, determine the problem id prefix : set - if is not empty, and set (set to empty) otherwise. Every reported problem id and every persisted key below carries this , so that analyses run under distinct prefixes occupy distinct id namespaces and hence do not overwrite each other.

    Before reporting, determine the effective severity floor : define the ordinal rank LOW=1, MEDIUM=2, HIGH=3, start from (default LOW), and - if is equal grey - raise to MEDIUM whenever its current rank is below rank(MEDIUM) (grey boxing surfaces only material findings of severity MEDIUM and above).

    Then apply the effective severity floor : Keep a detected problem if and only if its severity field is ACCEPTED or rank(severity) is greater than or equal to rank(<floor/>); silently drop all other problems (they are neither reported nor persisted). With the default floor LOW, all problems are kept. ACCEPTED problems are never dropped.

    Then sort the surviving problems in by their severity field from highest to lowest in the fixed order HIGH, MEDIUM, LOW, ACCEPTED, so the reporting starts with the most severe problem. Within the same severity, keep the file/line order established in STEP 2.

    Then renumber the surviving problems contiguously as <id-prefix/>P<n/> with = 1, 2, ... in that sorted ordering, so <id-prefix/>P1 is the most severe problem and the persisted ase-issue-<id-prefix/>P<n/> keys follow the reported sequence. If all problems are dropped, skip the per-problem report but still purge any stale persisted problems with a single ase_kv_batch call to the ase MCP server with transactional set to true and a commands parameter array holding exactly one { command: "clear", prefix: "ase-issue-<id-prefix/>" } entry, and still emit the final hint below.

    In this STEP 3, for EVERY surviving problem in , set to its severity field, to its title field, to its description field, to its evidence field, and to its trade-off field, and immediately report it with the following output , based on concise bullet points.

    PROBLEM (Severity: ): P:

    ⊙ EVIDENCE: ⊖ TRADEOFF:

    PROBLEM (Severity: ): P:

    Hints:

    • For the final results, do not output anything else, especially do not give any further explanations or information.

    • Uniquely identify the problems with <id-prefix/>P<n/> where is 1, 2, ...

    • Additionally, persist all reported problems in a single ase_kv_batch call to the ase MCP server with transactional set to true. The commands parameter array of this call starts with one { command: "clear", prefix: "ase-issue-<id-prefix/>" } entry (which removes only the previously persisted ase-issue-<id-prefix/>* keys, leaving any unrelated keys in the shared store intact), followed by one { command: "set", key: "ase-issue-<id-prefix/>P<n/>", val: "<title/>: <description/>" } entry per reported problem.

    Finally, give a final hint by expanding the following (which, depending on the configured , may expand into nothing and hence emit no output at all):

    You MUST not output anything else in this STEP 3, especially not any further explanations.

Signals

GitHub stars
52
Forks
5
Last commit
Sep 2026
Advanced
Catalog kind
skill
Gateway key
ase-code-analyze
Source
github.com/rse/ase