A Password= in appsettings.json, one FromSqlRaw($"... {id}") or ValidateLifetime = false is enough to lose your database or let anyone sign in. This skill finds those and nine other ASP.NET mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your .NET project: appsettings*.json, web.config, Program.cs, Startup.cs and the rest of your C# code. It skips comments, understands C# strings (including verbatim and interpolated ones), follows SQL built in a variable to the call that runs it, and knows when code sits inside an IsDevelopment() check. It knows the safe patterns: FromSqlInterpolated, parameters, user secrets and placeholders. It never runs dotnet. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• N01: a password in a connection string, or a secret-named setting with a literal value

• N02: SQL built with interpolation, + or string.Format and run with FromSqlRaw, ExecuteSqlRaw, SqlCommand and similar

• N03: the developer exception page outside development, or customErrors Off

• N04: CORS that allows any origin together with credentials

• N05: JWT validation that accepts unsigned tokens

REVIEW (check before release)

• N11: no HTTPS redirection and no HSTS in the pipeline

• N12: lifetime, issuer, audience or signing key checks turned off

• N13: certificate validation callbacks that accept anything

• N14: EnableSensitiveDataLogging outside development

• N15: cookies without Secure or HttpOnly

• N16: antiforgery turned off

• N17: debug compilation or tracing on in web.config

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example ASP.NET Core project, and the real report the scanner produces on the risky one

Limits

It reads code and config as text, not as a C# compiler: values are followed within one file. Environment variables, Azure Key Vault, user secrets and NuGet packages are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 14 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.