plc-code-analysis

# plc-code-analysis ## Goal Perform structured, multi-perspective security and quality analysis of PLC code, producing a severity-ranked findings report. Acts as an automated "second pair of eyes" for automation engineers. ## Independence from tia-openness-roadmap This skill is NOT routed by `tia-openness-roadmap`. It has its own trigger patterns and operates independently. The Openness roadmap handles engineering automation (create, modify, import/export via API). This skill handles analysis and review of existing code. The skill CAN consume code retrieved via MCP tools or Python/C# Openness exports, but it does not depend on them. ## Input recognition Claude receives PLC code in one of three ways. Identify which applies before starting analysis. ### Format 1 — Raw SCL / Structured Text The user pastes or uploads `.scl`, `.st`, or plain-text PLC code. This is the simplest case. Parse directly as text. Look for FUNCTION_BLOCK, FUNCTION, ORGANIZATION_BLOCK, DATA_BLOCK headers to identify block boundaries. ### Format 2 — SimaticML XML (exported LAD/FBD/SCL) The user provides `.xml` files exported from TIA Portal. These follow the SimaticML schema. Key navigation points: - `<SW.Blocks.FB>`, `<SW.Blocks.FC>`, `<SW.Blocks.OB>`, `<SW.Blocks.DB>` — block type - `<Interface>` → `<Section Name="Input|Output|InOut|Static|Temp|Constant">` — variable declarations - `<ObjectList>` → `<CompileUnit>` — individual networks - `<FlgNet>` inside CompileUnit — LAD/FBD network logic a...