OverviewHistoryStatsSecurity
npx skills add ...
Documentation
SKILL.md
npx skills add codewithmukesh/dotnet-claude-kit --skill security-scan
Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".
npx skills add codewithmukesh/dotnet-claude-kit --skill security-scan
Runs a defense-in-depth static scan across 6 layers. A project with zero CVEs can still have hardcoded secrets, SQL injection, and missing auth — each layer catches a different vulnerability class. Findings map to the OWASP Top 10:2025 taxonomy and are rated Critical/High/Medium/Low by exploitability, impact, and exposure — a Critical SQL injection on a public endpoint outranks a Low info-disclosure on an admin page.
Detection patterns, OWASP mappings, remediation code, and the report template
live in references/scan-layers.md — read it before executing.
Honesty rule: this is static analysis, not a penetration test. It catches known patterns but misses business-logic flaws, complex authorization bypasses, and runtime-only vulnerabilities. Every report states this.
| Scenario | Layers |
|---|---|
| Pre-release gate / pentest prep / incident / quarterly | All 6 |
| After dependency update | 1 |
| New endpoint added | 3, 4, 5 |
| Auth system changes | 4 |
| Config file changes | 2 |
| Logging changes | 6 |
| Public API exposure | 3, 4, 5 |
| Internal-only service | 1, 2, 3 |
Read references/scan-layers.md for the detection patterns per layer.
Delegate deep auth and secrets review to the security-auditor agent, pairing
the authentication and configuration skills.
| # | Layer | OWASP 2025 | Method |
|---|---|---|---|
| 1 | Package vulnerabilities | A03 Supply Chain | dotnet list package --vulnerable --include-transitive |
| 2 | Secrets detection | — | Pattern scan over .cs/.json/.yml/.xml/.config |
| 3 | OWASP code patterns | A05 Injection, A08 Integrity, A04 Crypto, A01 Access Control | Source scan: raw SQL, Html.Raw, BinaryFormatter, MD5/SHA1, IDOR |
| 4 | Auth configuration | A07 Authentication, A01 Access Control | get_endpoint_map — every route's auth posture in one call; flag unmarked endpoints; then JWT validation settings |
| 5 | CORS policy | A02 Misconfiguration | Wildcard origins, credentials combos, method/header breadth |
| 6 | Data protection | A04 Crypto, A09 Logging & Alerting | PII in logs, over-broad responses, plaintext sensitive storage |
Severity must match actual risk — over-classification causes alert fatigue and buries the real Critical:
Every finding: [SEVERITY] file:line — title, OWASP category, what's wrong,
impact if exploited, and remediation code (before/after). Produce the summary
table + per-layer status table from the reference template, prefixed with the
static-analysis disclaimer.
references/scan-layers.md — detection patterns, OWASP 2025 mappings, report template/verify — Phase 5 runs a lightweight version of this scan per change set/health-check — Dimension 7 (Security Posture) is the spot-check versionauthentication / configuration — remediation patterns for Layers 4 and 2