Run Your First Scan

Learning Objectives

• Describe how natural language prompts translate into specific Code Analyzer commands and checking engines.
  
• Identify the library package required to manage portable Code Analyzer skills.
  

Start Scanning Your Code Using Skills

Skills are bundles of domain logic, specialized instructions, automated scripts, and structural schemas. Skills load contextually into the runtime environment on demand. Use Salesforce Code Analyzer Skills to configure engines, analyze source code, manage rulesets, and implement automated continuous integration (CI/CD) pipelines through natural language text inputs.

Depending on your preferred development setup, you can access and activate Code Analyzer skills in two primary ways.

• Agentforce Vibes: Skills are preinstalled. Agentforce Vibes discovers configuration in your workspace and links natural language commands to Code Analyzer’s core checking engines.
  
• Standalone autonomous AI tools: If you use tools such as Claude Code, Cursor, or Windsurf, install and manage portable skills via the core Salesforce Skills Library (@forcedotcom/sf-skills).
  

Onboard a New Repository for CalcPro Use Case

Your team at AW Computing just inherited a legacy repository containing older logic for the CalcPro app. Before integrating it into your main codebase, you need to clean it up, configure the scanning environment, and enforce a custom company security rule. Instead of doing this manually, you use Code Analyzer skills to handle the high-effort work.

Transform Natural Language into Commands

You start by searching for messy, repetitive code left behind by the previous developers. Instead of digging through documentation to find the exact syntax, you simply enter your request in plain language—Find duplicate code in the CalcPro legacy repository.

The system automatically translates your intent and executes the exact command to run the Copy-Paste Detector (CPD) engine, which saves the results directly to a time-stamped file.

sf code-analyzer run --rule-selector cpd --output-file "./code-analyzer-results-20260710-1522.json"

Inspect the Target Repository and Environment Setup

Next, you need to make sure that the repository is configured correctly for automated scans. The agent automatically inspects the target repository's structure. It detects that the folder contains a mix of Apex backend files and Lightning Web Component JavaScript files.

The agent automatically creates a tailored configuration file for your project structure, which saves you from writing the initial setup code from scratch.

Automate Custom PMD Rules and Parameter Properties

Finally, AW Computing has a strict internal policy—sales reps' commission formulas must never be hardcoded in Apex. You need a custom PMD rule to flag this, but writing the abstract syntax tree matching logic is difficult.

You give the agent your requirement in plain language—Create a custom rule to flag hardcoded decimal values inside classes matching the name 'CommissionLogic', but ignore any test classes.

The agent evaluates the requirement, details a plan, and automatically updates your configuration.

• It writes the exact XPath pattern needed to detect hardcoded numbers in the Abstract Syntax Tree (AST).
  
• It maps the properties correctly into your configuration file.
  
• It automatically sets up file exclusions so the scanner ignores your test classes (*Test.cls), which prevents false positives.
  

By using these skills, you go from a messy, unconfigured repository to a fully tailored, automated scanning pipeline in just a few minutes.

Now that you know how to execute CLI commands and use AI skills to automate your scanning pipeline, you're ready to put this knowledge into practice. The next unit includes a Hands-On Check, where you apply these tools to scan a live codebase and resolve code violations in real time. Whenever you’re ready, jump into the challenge and finish the badge!