From vanguard-frontier-agentic
Reviews ASP.NET Core API architecture: middleware ordering, DI lifetimes, CORS, validation, versioning, error handling, rate limiting, and health/readiness endpoints.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:dotnet-aspnetcore-api-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill reviews how an ASP.NET Core HTTP API is assembled — the middleware pipeline, dependency-injection lifetimes, and the cross-cutting concerns that decide whether requests are handled safely and predictably. The order middleware is registered in is the order it executes, so a misordered pipeline silently bypasses authentication, leaks exceptions, or applies CORS too late to matter. The ...
This skill reviews how an ASP.NET Core HTTP API is assembled — the middleware pipeline, dependency-injection lifetimes, and the cross-cutting concerns that decide whether requests are handled safely and predictably. The order middleware is registered in is the order it executes, so a misordered pipeline silently bypasses authentication, leaks exceptions, or applies CORS too late to matter. The review catches misordered auth middleware, unsafe CORS combinations, captive dependencies, unversioned public surfaces, exception leakage, unvalidated bound input, missing rate limiting on mutating endpoints, and a health endpoint doing a readiness job. It is a static review of source and sanitized configuration; it never runs the app, calls endpoints, or contacts live systems.
Program.cs, startup wiring, controllers, minimal-API endpoint definitions) or sanitized appsettings.UseAuthorization registered before UseAuthentication, or auth middleware registered after terminal/endpoint middleware, as a pipeline that does not authenticate or authorize requests.AllowAnyOrigin combined with AllowCredentials as an invalid, credential-exposing CORS policy.[AllowAnonymous] or wildcard CORS as a fix; never recommend disabling a failing gate as the fix.confirmed (config provided), inference (config partial), assumption (config absent), or unknown.Load these only when needed:
Return, at minimum:
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticScans .NET applications for vulnerabilities across 6 layers: packages, secrets, OWASP patterns, auth, CORS, data protection. Produces severity-rated findings with remediation.
Securing .NET code or reviewing for vulnerabilities. OWASP Top 10 mitigations, pattern warnings.
Reviews .NET Aspire AppHost and ServiceDefaults projects for cloud-native readiness: health checks, resiliency, secrets, configuration drift, and container evidence.