csharp_review

Review C# code for language-dependent defects and system-level risks beyond Roslyn diagnostics.

4|Updated Jan 31, 2026
One-click install
npx skills add https://github.com/synthaicode/XRefKit --skill csharp-review-synthaicode
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csharp_review
Source: https://github.com/synthaicode/XRefKit/tree/main/skills/csharp_review
Command: npx skills add https://github.com/synthaicode/XRefKit --skill csharp-review-synthaicode

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyyaml, and includes references (resource) components.

What problem does it solve? Static analyzers like Roslyn catch compiler-level issues, but they miss language-dependent defects and system-level implementation risks such as async hangs, fake-clock wait loops, connection churn, silent fallbacks, and broken context propagation. This Skill performs a structured, evidence-based C# code review across twelve review categories and produces findings with severity, evidence, and remediation. ## Core Features & Use Cases - Twelve review categories: Covers attribute activation/precondition mismatch, resource efficiency, operational resilience, synchronization, business input integrity, support lifecycle, error handling, time/culture, state/determinism, uncertainty escalation, contract/schema resilience, and traceability/context propagation. - Gate verdict routing: Emits a pre-CI verdict (blocked, needs-review, or proceed) with evidence and downgrade reasons, routing the diff without asserting correctness. - Structured handoffs: Routes security findings, XDDP trace gaps, and design-assumption issues to specialist skills instead of silently absorbing them. - Use Case: Point the Skill at a .NET solution before merging a pull request; it establishes the Roslyn baseline, reviews each active category (optionally via subagents), and returns a check item matrix plus a findings list with file-level evidence and remediation. ## Quick Start Ask the AI to run a C# review on your repository or solution path, optionally specifying scope filters and whether you want findings only or findings with fixes.

Frequently Asked Questions about csharp_review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review C# code beyond what Roslyn analyzers catch?▼

Run this Skill against a repository, solution, or project path. It establishes the Roslyn diagnostic baseline first, then reviews twelve categories such as synchronization, resource efficiency, and error handling, producing evidence-backed findings with severity and remediation.

What kinds of C# async and concurrency issues can be detected?▼

The review covers async blocking, context-capture pitfalls, and fake-clock or virtual-clock wait loops that can hang forever when a state change never wakes the waiter. It also checks ThreadPool saturation, connection-pool misuse, and socket exhaustion patterns.

Does this C# review replace security review or design review?▼

No. Security findings such as injection paths or hardcoded secrets are routed to a security review handoff, and design-assumption or trace-continuity gaps are handed off to dedicated skills. The review records them without deep-diving outside its scope.

What happens when the Roslyn baseline cannot be collected?▼

The review continues and marks the output with baseline_unavailable, recorded as a risk concern. Findings that cannot be statically verified are downgraded to needs_confirmation with the missing evidence explicitly named.

Can the review handle large solutions with many projects?▼

Yes. When scope spans many projects, categories, or files, execution is decomposed into subagents split by scope or category so no single context loses coverage. The coordinator keeps the category matrix, merges duplicates, and issues the final gate verdict.

Why does a finding get marked needs_confirmation instead of a severity?▼

A finding is marked needs_confirmation when applicable evidence exists but is insufficient to decide, or when a remediation asserts a third-party API fact that could not be verified against the referenced package version. Unverified claims are never reported as confirmed defects.