The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill correctly instructs developers to avoid hardcoding secrets and instead use standard secure storage mechanisms like .NET user-secrets for development and Azure Key Vault or environment variables for production. References to connection strings and tokens in documentation are clearly marked as placeholders or examples of what NOT to do.
[COMMAND_EXECUTION]: The skill uses dotnet list package --vulnerable to check for supply chain issues. This is a standard, built-in .NET CLI command used for security auditing and does not involve arbitrary or dangerous command execution.
[DATA_EXPOSURE]: The skill actively promotes data protection by scanning for PII (Personally Identifiable Information) in logs and ensuring sensitive fields are excluded from API responses using DTOs.
[SAFE]: The documentation and logic align with the OWASP Top 10:2025 standards, providing accurate and helpful remediation steps for common vulnerabilities like SQL Injection, XSS, and insecure deserialization.

security-scan