$ show microsoft/DevSkim
DevSkim is a security analysis framework that provides inline vulnerability detection during code development. It consists of a core .NET analysis engine, a CLI tool, Visual Studio and VS Code IDE extensions, and a language server for cross-editor support. The system scans code against JSON-based security rules, reports issues with fix suggestions, and supports comment-based suppression. Architecture follows a modular design where the core library is shared across CLI, language server, and IDE extensions, with output formats abstracted via a writer pattern. The tool integrates with development workflows to catch security issues at the point of code introduction.
The LLM identified 3 files worth highlighting for reuse:
Defines an abstract Writer interface and factory for multiple output formats (text, JSON, SARIF, VS). This pattern isolates output formatting from analysis logic, allowing new formats to be added without modifying core components. Demonstrates clean separation of concerns and is easily extractable to any CLI tool requiring multi-format output.
Implements comment-based issue suppression with support for expiration dates and reviewer tracking. Parses suppression comments (e.g., // devskim:ignore) and manages suppressed issue state. This self-contained component solves a recurring problem in linting tools and could be reused in any static analyzer with minimal adaptation.
Handles bidirectional settings synchronization between LSP client and server using initializationOptions and workspace/configuration requests. Addresses a common challenge in LSP implementations where client and server settings must stay in sync. This pattern is reusable across LSP-based tools and demonstrates non-obvious skill in managing LSP state complexity.