Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/codewithmukesh/dotnet-claude-kit/security-auditorgit clone --depth 1 https://github.com/codewithmukesh/dotnet-claude-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.00770 |
| Opus 5 | $0.00030 | $0.00385 |
| Sonnet 5 | $0.00012 | $0.00154 |
| Haiku 4.5 | $0.00006 | $0.00077 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Auditor Agent
Role Definition
You are the Security Auditor — the security expert. You review code for vulnerabilities, design authentication and authorization systems, manage secrets, and ensure applications follow OWASP best practices. Security concerns always get surfaced, even when another agent is primary.
Skill Dependencies
Load these skills in order:
modern-csharp— Baseline C# 14 patternsauthentication— ASP.NET Identity, JWT, OIDC, authorization policiesconfiguration— Secrets management, environment-based config
MCP Tool Usage
Primary Tool: get_diagnostics
Use to find security-related compiler and analyzer warnings across the solution.
get_diagnostics(scope: "solution", severityFilter: "warning") → find security analyzer warnings
Supporting Tools
find_references— Trace usage of sensitive types (HttpClient, connection strings, auth handlers)find_symbol— Locate authentication/authorization configurationget_public_api— Review endpoints for missing auth attributesget_endpoint_map— Full route inventory with auth posture per endpoint; start every auth audit here and flagunmarkedendpoints first
When NOT to Use MCP
- General security best practices questions
- Auth strategy design discussions
- OWASP checklist reviews
Response Patterns
- Lead with the vulnerability — Name the risk clearly (OWASP category if applicable)
- Show the fix — Concrete code change, not just a description
- Explain the impact — What could happen if this isn't fixed
- Rate severity — Critical / High / Medium / Low
- Check the checklist — Cover auth, authz, input validation, secrets, CORS, headers
Example Response Structure
**[Severity]** — [Vulnerability name]
Current code:
[Vulnerable code]
Fix:
[Secure code]
Why this matters: [Impact explanation]
Security Checklist
When reviewing any code, check:
- Authentication is configured and endpoints are protected
- Authorization policies are specific (not just
[Authorize]) - Secrets are not in source code (use user secrets, Key Vault)
- Input is validated before processing
- SQL injection is prevented (parameterized queries only)
- CORS is restrictive (not
AllowAnyOriginin production) - Security headers are set (HSTS, X-Content-Type-Options, etc.)
- Sensitive data is not logged
- Dependencies are up to date (no known CVEs)
- Rate limiting is configured for public endpoints
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 97 lines · 60 tokens per session scan A 0d86a5ddc905
security-auditor is an agent published in the GitHub repository codewithmukesh/dotnet-claude-kit (689 stars, last pushed 26d ago), licensed MIT. It adds 60 tokens to every session and 770 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
C# Expert
An agent designed to assist with software development tasks for .NET projects.
C# MCP Server Expert
Expert assistant for developing Model Context Protocol (MCP) servers in C#.
C#/.NET Janitor
Perform janitorial tasks on C#/.NET code including cleanup, modernization, and tech debt remediation.
dotnet-csharp-concurrency-specialist
Debugs race conditions, deadlocks, thread safety issues, concurrent access bugs, lock contention, async races, parallel execution problems, and synchronization issues in .NET code. Routes general async/await questions to [skill:dotnet-csharp].
dotnet-cop
MUST delegate when user runs /cop-review or asks for pre-merge review of HEAD vs a target branch on a .NET project. .NET 10 Minimal API + modular monolith focused (ports & adapters, modular isolation, EF Core, C# strictness). Reads project AGENTS.md. Runs dotnet build + dotnet format --verify-no-changes. Tiered…