/roslyn-query

name: roslyn-query
description: Query .NET/C# codebases using Roslyn AST analysis via dotnet run file. Use for tracing data flow, auditing API usage, finding pattern violations, or ad-hoc codebase queries.
argument-hint: "[analysis description or query type]"

Roslyn Query

Query .NET/C# codebases using Roslyn AST analysis scripts executed via `dotnet run file.cs`.

Before generating scripts, load the `handbook-dotnet:dotnet-run-file` skill for execution conventions and directive syntax.

When to Use

• Trace data flow from sources to sinks (taint analysis)
• Audit all assignments to specific properties
• Find all callers of a method
• Find all implementations of an interface
• Detect pattern violations (empty catches, missing sanitizers, etc.)
• Architecture validation (layer violations)
• Ad-hoc codebase structural queries

Analysis Tiers

Tier 1: Syntax-Only (fast, no compilation)

Uses `CSharpSyntaxTree.ParseText()` — parses files individually, no solution loading.

Best for:

• Property assignment audits (`x.Content = ...`)
• Empty catch block detection
• Naming convention checks
• Cyclomatic complexity
• Magic number/string detection
• Method size metrics
• Pattern matching on code structure

Tier 2: Semantic (needs project/solution)

Uses `MSBuildWorkspace` — loads project, resolves types, enables cross-file analysis.

Best for:

• Find all callers of a method (`SymbolFinder.FindCallersAsync`)
• Find interface implementations (`SymbolFinder.FindImplementationsAsync`)
• Find method overrides (`SymbolFinder.FindOverridesAsync`)
• Type dependency graphs
• Full data flow analysis (`SemanticModel.AnalyzeDataFlow`)

Instructions

Step 1: Determine analysis type

Based on the user's request, choose the appropriate template from `references/templates.md`. If no template fits, compose a custom script using the patterns documented there.

Step 2: Generate the script

Create a `.cs` file in a `scripts/` directory (or temp location) using `dotnet run file.cs` format with `#:package` directives.

For syntax-only analysis:

#:package Microsoft.CodeAnalysis.CSharp@4.*

For semantic analysis, additionally:

#:package Microsoft.CodeAnalysis.CSharp.Workspaces@4.*
#:package Microsoft.CodeAnalysis.Workspaces.MSBuild@4.*
#:package Microsoft.Build.Locator@1.*
#:property DisableMSBuildAssemblyCopyCheck=true

> **Note:** `DisableMSBuildAssemblyCopyCheck=true` suppresses the MSBL001 build error that requires `ExcludeAssets="runtime"` on MSBuild packages — an attribute `#:package` directives can't express. Safe for throwaway analysis scripts. > > **`.slnx` not supported:** Roslyn 4.x `MSBuildWorkspace` only supports `.sln`, not `.slnx`. Use `OpenProjectAsync` with a `.csproj` instead — transitive project references are loaded automatically.

Step 3: Script conventions

• Accept target directory/path via `args[0]`, default to `Directory.GetCurrentDirectory()`
• Use `Path.GetRelativePath()` for output paths
• Print structured output: file:line, description, context
• Use color: green for safe, yellow for warnings, red for violations
• Exit code 0 = clean, 1 = findings

Step 4: Execute

dotnet run scripts/my-analysis.cs -- <target-path>

Step 5: Interpret results

Analyze the output. For taint analysis, categorize findings:

• **Safe** — trusted source (code-generated, AI output, literal null)
• **Already sanitized** — sanitizer call deeper in call chain (syntax-only false positive)
• **Needs investigation** — external input, user-authored content
• **Violation** — clear miss that should be fixed

Key Roslyn APIs Quick Reference

Load `references/roslyn-api.md` for detailed API reference with code examples.

Templates

Load `references/templates.md` for ready-to-use analysis script templates.