Security Scan

codewithmukesh/dotnet-claude-kit/skills/security-scan

by codewithmukesh23300897f4d1No license754 starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated 2 months ago

Deep security scanning for .NET applications across 6 layers: vulnerable packages, secrets detection, OWASP code patterns, auth configuration, CORS policy, and data protection. Produces severity-rated findings with specific remediation steps. Load this skill when: "security scan", "security audit", "check for vulnerabilities", "find secrets", "OWASP", "auth review", "CORS check", "security review", "penetration test prep", "CVE check", "vulnerability scan", "hardcoded password", "data protection", "security posture".

Instructions onlySecurity

AI-generated overview

Static 6-layer security scan for .NET apps covering packages, secrets, OWASP patterns, auth, CORS and data protection.

What it does: This skill defines a six-layer static security scan for .NET applications: vulnerable packages, secrets detection, OWASP code patterns, authentication configuration, CORS policy, and data protection. It produces severity-rated findings (Critical/High/Medium/Low) mapped to the OWASP Top 10:2025, each with file and line, impact, and before/after remediation code. Output includes a summary table and per-layer status table, prefixed with a disclaimer that this is static analysis, not a penetration test. Detection patterns and the report template live in references/scan-layers.md.
When to use it: Use it as a pre-release security gate, before a paid penetration test, after dependency, auth, config or logging changes, during incident response, or for quarterly security reviews. It also fits requests phrased as security scan, security audit, find secrets, CVE check, OWASP review, or CORS check.
Requirements: No scripts ship with the skill; it is instructions only. It expects a .NET project and the dotnet CLI for the package-vulnerability layer, plus the referenced scan-layers.md file. It mentions delegating deep auth and secrets review to a security-auditor agent and pairing the authentication and configuration skills.

/security-scan — 6-Layer Security Pipeline

What

Runs a defense-in-depth static scan across 6 layers. A project with zero CVEs can still have hardcoded secrets, SQL injection, and missing auth — each layer catches a different vulnerability class. Findings map to the OWASP Top 10:2025 taxonomy and are rated Critical/High/Medium/Low by exploitability, impact, and exposure — a Critical SQL injection on a public endpoint outranks a Low info-disclosure on an admin page.

Detection patterns, OWASP mappings, remediation code, and the report template live in references/scan-layers.md — read it before executing.

Honesty rule: this is static analysis, not a penetration test. It catches known patterns but misses business-logic flaws, complex authorization bypasses, and runtime-only vulnerabilities. Every report states this.

When

Pre-release security gate — full scan, non-negotiable before production
"Security scan", "security audit", "find secrets", "CVE check", "OWASP"
After a dependency update (Layer 1), auth changes (Layer 4), config changes (Layer 2), or logging changes (Layer 6)
Pre-pentest preparation — fix static issues before paying for a pentest
Incident response and quarterly reviews

How

Step 1: Choose Layers

Scenario	Layers
Pre-release gate / pentest prep / incident / quarterly	All 6
After dependency update	1
New endpoint added	3, 4, 5
Auth system changes	4
Config file changes	2
Logging changes	6
Public API exposure	3, 4, 5
Internal-only service	1, 2, 3

Step 2: Execute the Layers

Read references/scan-layers.md for the detection patterns per layer. Delegate deep auth and secrets review to the security-auditor agent, pairing the authentication and configuration skills.

#	Layer	OWASP 2025	Method
1	Package vulnerabilities	A03 Supply Chain	`dotnet list package --vulnerable --include-transitive`
2	Secrets detection	—	Pattern scan over .cs/.json/.yml/.xml/.config
3	OWASP code patterns	A05 Injection, A08 Integrity, A04 Crypto, A01 Access Control	Source scan: raw SQL, `Html.Raw`, `BinaryFormatter`, MD5/SHA1, IDOR
4	Auth configuration	A07 Authentication, A01 Access Control	`get_endpoint_map` — every route's auth posture in one call; flag `unmarked` endpoints; then JWT validation settings
5	CORS policy	A02 Misconfiguration	Wildcard origins, credentials combos, method/header breadth
6	Data protection	A04 Crypto, A09 Logging & Alerting	PII in logs, over-broad responses, plaintext sensitive storage

Step 3: Rate with Context

Severity must match actual risk — over-classification causes alert fatigue and buries the real Critical:

Test-fixture "secrets" and appsettings.Development.json values are expected — skip or mark INFO, don't flag as HIGH
A missing XML comment is never a security finding
Reserve Critical for exploitable-now issues: injection on public endpoints, exposed production secrets, auth bypass

Step 4: Report

Every finding: [SEVERITY] file:line — title, OWASP category, what's wrong, impact if exploited, and remediation code (before/after). Produce the summary table + per-layer status table from the reference template, prefixed with the static-analysis disclaimer.

Example

User: /security-scan before we ship
Claude: Running all 6 layers...
| Layer | Status | Findings ||-------|--------|----------|| 1. Packages | PASS | 0 CVEs (142 packages incl. transitive) || 2. Secrets | PASS | 0 real secrets (2 dev-only values skipped) || 3. OWASP Patterns | FAIL | 1 SQL injection || 4. Auth Config | WARN | 2 endpoints missing explicit auth attributes || 5. CORS | PASS | Explicit origins from configuration || 6. Data Protection | WARN | Customer email logged at Information level |
[HIGH] SearchOrders.cs:34 — SQL Injection (A05:2025)  FromSqlRaw($"...LIKE '%{search}%'") → attacker controls the query.  Fix: db.Orders.Where(o => EF.Functions.Like(o.Name, $"%{search}%"))
[MEDIUM] OrderEndpoints.cs:18,31 — no [Authorize]/[AllowAnonymous]; behavior  depends on ambient global policy. Make intent explicit per endpoint.
[LOW] OrderPlacedHandler.cs:22 — PII in logs (A09:2025). Log CustomerId, not email.
Note: static analysis only — this does not replace a penetration test.

User: /security-scan before we ship
Claude: Running all 6 layers...
| Layer | Status | Findings ||-------|--------|----------|| 1. Packages | PASS | 0 CVEs (142 packages incl. transitive) || 2. Secrets | PASS | 0 real secrets (2 dev-only values skipped) || 3. OWASP Patterns | FAIL | 1 SQL injection || 4. Auth Config | WARN | 2 endpoints missing explicit auth attributes || 5. CORS | PASS | Explicit origins from configuration || 6. Data Protection | WARN | Customer email logged at Information level |
[HIGH] SearchOrders.cs:34 — SQL Injection (A05:2025)  FromSqlRaw($"...LIKE '%{search}%'") → attacker controls the query.  Fix: db.Orders.Where(o => EF.Functions.Like(o.Name, $"%{search}%"))
[MEDIUM] OrderEndpoints.cs:18,31 — no [Authorize]/[AllowAnonymous]; behavior  depends on ambient global policy. Make intent explicit per endpoint.
[LOW] OrderPlacedHandler.cs:22 — PII in logs (A09:2025). Log CustomerId, not email.
Note: static analysis only — this does not replace a penetration test.

references/scan-layers.md — detection patterns, OWASP 2025 mappings, report template
/verify — Phase 5 runs a lightweight version of this scan per change set
/health-check — Dimension 7 (Security Posture) is the spot-check version
authentication / configuration — remediation patterns for Layers 4 and 2

Source and attribution

Source:codewithmukesh/dotnet-claude-kitinskills/security-scanat commit2330089

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from codewithmukesh/dotnet-claude-kit

Wrap Up

codewithmukesh

Captures end-of-session work, pending tasks and learnings into a handoff file, and reloads it at session start.

Productivity & Workflow754updated 2 months ago

Workflow Mastery

codewithmukesh

Claude Code workflow mastery for .NET developers. Covers parallel execution with git worktrees, plan mode strategy, verification loops, auto-formatting hooks, permission setup for dotnet CLI, prompting techniques, subagent patterns, and context discipline — token budget management, MCP-first navigation, lazy loading, and subagent isolation — all adapted for the .NET ecosystem. Load this skill when setting up Claude Code for a .NET project, optimizing workflows, running parallel sessions, when context is running low or sessions feel sluggish, when exploring a large codebase efficiently, or when the user mentions "productivity", "workflow", "parallel", "worktree", "plan mode", "permissions", "hooks", "10x", "setup Claude Code", "speed up development", "context", "tokens", "budget", "running out of context", "too many files", or "large codebase". Inspired by tips from Boris Cherny (creator of Claude Code) and the Anthropic team.

Awaiting classification754updated 2 months ago

Vertical Slice

codewithmukesh

Guides .NET developers in structuring applications with Vertical Slice Architecture, covering feature folders, endpoint grouping and handler patterns.

Software Development754updated 2 months ago

Testing

codewithmukesh

Testing strategy for .NET 10 applications. Covers xUnit v3, WebApplicationFactory for integration tests, Testcontainers for real database testing, Verify for snapshot testing, and the AAA pattern. Load this skill when writing tests, setting up test infrastructure, reviewing test coverage, or when the user mentions "test", "xUnit", "WebApplicationFactory", "Testcontainers", "integration test", "unit test", "bUnit", "snapshot test", "Verify", "test coverage", "AAA pattern", "WireMock", or "FakeTimeProvider".

Awaiting classification754updated 2 months ago

Tdd

codewithmukesh

Guided test-driven development workflow for .NET 10 using xUnit v3, WebApplicationFactory, Testcontainers, and Verify snapshots. Follows the strict red-green-refactor cycle. Use when: "TDD", "test-driven", "let's TDD this", "red green refactor", "write the test first", or when building a feature with clear acceptance criteria.

Awaiting classification754updated 2 months ago

Spec

codewithmukesh

Turns a vague feature idea into an agreed, persisted specification file through structured questioning rounds.

Productivity & Workflow754updated 2 months ago

Security Scan

/security-scan — 6-Layer Security Pipeline

What

When

How

Step 1: Choose Layers

Step 2: Execute the Layers

Step 3: Rate with Context

Step 4: Report

Example

Related

Source and attribution

More from codewithmukesh/dotnet-claude-kit

Wrap Up

Workflow Mastery

Vertical Slice

Testing

Tdd

Spec

More in Security

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt