.NET Best Practice Checker

Checks a .NET codebase against 30 concrete best-practice rules and writes a severity-ranked report. Each finding names the rule, the file and line, the offending code, one sentence on why it matters here, and a fix. The skill reads your code and changes nothing.

Use when you want a pre-review sweep of a C# solution, a "what would a reviewer flag" pass, or a first look at an inherited codebase.

Do not use for layering or architecture review, performance profiling, new feature work, single-snippet questions, or non-.NET code.

The 30 rules cover async and cancellation, exception handling, logging, HttpClient and certificate validation, time and disposal, dependency injection, secrets in config, EF Core queries and raw SQL, performance hygiene, target framework support, package versions and vulnerabilities, and test smells. Every rule has a search pattern, a way to confirm the hit in context, a fix, and a list of cases that are not findings, so an async void event handler or a .Result after Task.WhenAll is dropped instead of reported. The report ends with the hits it dropped and the rules it could not check.

Two optional steps run dotnet and the skill asks before either: an analyzer pass (dotnet build with AnalysisMode=All, filtered to the analyzer IDs the rules name) and a NuGet vulnerability check (dotnet list package --vulnerable). Without them the skill uses only the Read and Grep tools.

Features

• 30 named rules in 8 groups, each with severity, confirm step, fix and a "not a finding" list.
• Report ordered by severity with a summary table, checked-and-clean rules, rules not checked, and hits dropped.
• Evidence is path:line plus the code. Secret values are never printed; findings show the key name and ***.
• Findings that depend on something the scan cannot see are marked Likely, with what would settle them.
• Optional analyzer pass and NuGet advisory check, each only after you agree.
• A real sample report from a synthetic solution is included (examples/sample-report.md).
• Free, MIT licensed.

Who it is for

.NET developers and reviewers who use an AI coding agent and want a repeatable pre-review check of an ASP.NET Core, EF Core or class-library solution.

Requirements

• An agent that reads skill folders and gives the model file read and search tools (tested only in Claude Code 2.1.301).
• The .NET SDK, only for the two optional steps.
• No API keys, accounts or environment variables.

Supported environments

Environment	Status
Claude Code 2.1.301 on Windows, Sonnet model	Tested on one synthetic solution (see docs/VALIDATION.md)
Other Claude models	Untested
Cursor, GitHub Copilot, Codex CLI, Gemini CLI	Untested
Linux, macOS	Untested

Limitations

• It is a text-based scan. It does not resolve types, DI lifetimes or runtime configuration, so some findings are marked Likely.
• The rules are one author's judgment of common review findings, not Microsoft guidance, and not a complete security audit.
• Tuned and tested on one synthetic solution that I wrote. The false-positive rate on real projects is unknown.
• .NET support dates were read from Microsoft's support policy page on 2026-10-17. Check the page before relying on them later.
• Large solutions: matches beyond 25 per rule are counted but not all reviewed, and the report says so.

Network and external references (disclosure)

• The scan makes no network calls and sends no repository content anywhere.
• The optional dotnet list package --vulnerable step queries the NuGet feeds in your repo's configuration. The optional dotnet build restores packages from the same feeds and writes bin/ and obj/.
• The skill asks before running either step.
• The package contains Markdown only: no scripts and no binaries.

Use cases

• Sweep a pull-request branch or a whole solution before human review.
• Take a first look at an inherited .NET codebase and see what to fix first.
• Find blocking calls, swallowed exceptions, disabled certificate validation, committed secrets and SQL built by string concatenation.
• Check target frameworks and NuGet packages against support dates and known advisories.