ClearTextPassword value="ghp_..." in a committed NuGet.config gives your feed token to everyone who can read the repository, and a private feed added next to nuget.org without packageSourceMapping lets a public package with your internal package's name be restored instead. This skill finds those and nine other NuGet mistakes before you restore or commit, and tells you how to fix each one.

Your agent runs a scanner on your NuGet.config files, project files (.csproj, .fsproj, .vbproj, SDK-style and old-style), Directory.Packages.props (Central Package Management), Directory.Build.props and packages.lock.json. It parses the XML and points at the exact line, understands NuGet's %VAR% references, MSBuild $(Property) values, cleared and disabled sources and NuGet's version range notation, and tells application projects from libraries and test projects for the lock-file rule. It never runs dotnet, restores packages or contacts a feed. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• N01: package, audit or push sources over plain http://, also when allowInsecureConnections is set

• N02: feed passwords, tokens and API keys in plain text (ClearTextPassword, unencrypted Password or apikeys values, user:password in a URL)

• N03: disableTLSCertificateValidation on a package source

REVIEW (check before release)

• N11: floating versions (8.*, *) and version ranges without an inclusive lower bound

• N12: prerelease packages (-beta, -preview, -rc)

• N13: several package sources without packageSourceMapping, counting nuget.org when the source list is not cleared

• N14: application projects without packages.lock.json, and lock files turned on but not committed

• N15: allowInsecureConnections on an https source

• N16: encrypted passwords and API keys committed in a project NuGet.config

• N17: NuGetAudit turned off, or vulnerability warnings NU1901-NU1904 hidden with NoWarn

• N18: trusted signers with allowUntrustedRoot

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example .NET solution (NuGet.config, Directory.Build.props, Central Package Management, an ASP.NET Core project and its lock file), and the real report the scanner produces on the risky one

Limits

It reads each file as written: settings merged from user-level and machine-wide NuGet configs, command-line options, environment variables, other imported .props and .targets files and MSBuild conditions are not evaluated, and packages.config and .nuspec files are not checked. It does not look up packages, so known vulnerabilities and package names taken on nuget.org are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 16 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.