agentmods.dev

dotnet-security-reviewer

dotnet-security-reviewer is an agent for Claude Code from novotnyllc/dotnet-artisan. It costs 36 tokens per session (1,242 once invoked), scanned A, original, MIT.

A read-only security reviewer for .NET code, configuration, and dependencies that checks for vulnerabilities, exposed secrets, weak cryptography, and OWASP-related issues.

In plain words
What is it for?
Use it to review authentication and authorization code, secret handling, configuration files, cryptographic choices, dependencies, and other .NET security concerns.
Why use it?
It identifies security risks without changing the code and explains where they occur and how they can be addressed.

Agent for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: model in frontmatter; mentions subagents.

Part of the dotnet-artisan plugin — 9 skills, 14 agents, 2 MCP servers shipped together

not rated 229repo +1 21d ago A scan 36 tokens original MIT

Good fit Use it to review authentication and authorization code, secret handling, configuration files, cryptographic choices, dependencies, and other .NET security concerns.

Compare 6 agents from other repositories ↓
Install with agentmods
npx agentmods add agents/novotnyllc/dotnet-artisan/dotnet-security-reviewer
View source ↗ novotnyllc/dotnet-artisan
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/novotnyllc/dotnet-artisan

Made for: Claude Code.

Or install dotnet-artisan, the plugin that ships this one along with the rest of its 9 skills, 14 agents, 2 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dotnet-security-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/novotnyllc/dotnet-artisan/dotnet-security-reviewer.svg)](https://agentmods.dev/agents/novotnyllc/dotnet-artisan/dotnet-security-reviewer)
Your own site
<a href="https://agentmods.dev/agents/novotnyllc/dotnet-artisan/dotnet-security-reviewer"><img src="https://agentmods.dev/badge/agents/novotnyllc/dotnet-artisan/dotnet-security-reviewer.svg" alt="Measured on agentmods" height="20"></a>
Per session 36 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,242 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00036 $0.01242
Opus 5 $0.00018 $0.00621
Sonnet 5 $0.00007 $0.00248
Haiku 4.5 $0.00004 $0.00124

Measured 9d ago against content hash 250bd5794942, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

dotnet-security-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/dotnet-artisan/agents/dotnet-security-reviewer.md · 90 lines

How it starts

The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.

dotnet-security-reviewer

Security review subagent for .NET projects. Performs read-only analysis of source code, configuration, and dependencies to identify security vulnerabilities, secrets exposure, and cryptographic misuse. Never modifies code -- produces findings with severity, location, and remediation guidance.

Preloaded Skills

Always load these skills before analysis:

  • [skill:dotnet-advisor] -- router/index for all .NET skills; consult its catalog to find specialist skills
  • [skill:dotnet-api] (read references/security-owasp.md) -- OWASP Top 10 mitigations and deprecated security pattern warnings
  • [skill:dotnet-api] (read references/secrets-management.md) -- secrets handling, user secrets, environment variables, anti-patterns
  • [skill:dotnet-api] (read references/cryptography.md) -- cryptographic algorithm selection, hashing, encryption, post-quantum guidance

Workflow

  1. Scan configuration -- Search for secrets in appsettings*.json, .env files, and source code. Check for hardcoded connection strings, API keys, and passwords. Verify .gitignore excludes secret files. Reference [skill:dotnet-api] (read references/secrets-management.md) for anti-patterns.

  2. Review OWASP compliance -- For each OWASP Top 10 category, check relevant code patterns:

    • A01: Verify [Authorize] attributes and fallback policy
    • A02: Check for weak crypto (MD5, SHA1, DES, RC2) and plaintext secrets
    • A03: Look for SQL injection (string concatenation in queries), XSS (raw HTML output), command injection
    • A04: Verify rate limiting, anti-forgery tokens, request size limits
    • A05: Check for UseDeveloperExceptionPage without environment gate, missing security headers
    • A06: Check NuGetAudit settings in project files; flag if NuGetAuditMode is missing or not all
    • A07: Review Identity/cookie configuration (password policy, lockout, secure cookies)
    • A08: Search for BinaryFormatter, unsigned package sources, missing source mapping
    • A09: Verify security event logging without sensitive data exposure
    • A10: Check HttpClient usage with user-supplied URLs

Read the full file on GitHub · 90 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 90 lines · 36 tokens per session scan A 250bd5794942

Subscribe to this mod's changes

dotnet-security-reviewer is an agent published in the GitHub repository novotnyllc/dotnet-artisan (229 stars, last pushed 21d ago), licensed MIT. It adds 36 tokens to every session and 1,242 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

C# and .NETLanguagesSecurity
Related

Other agents, from other repositories

WinForms Expert

Support development of .NET (OOP) WinForms Designer compatible Apps.

github/awesome-copilot · 19 tokens

dotnet-fullstack-mentor

Opinionated mentor for .NET full-stack development, guiding career progression from junior to staff levels with expertise in Clean Architecture, Aspire, and C# best practices.

github/awesome-copilot · 39 tokens

C# MCP Server Expert

Expert assistant for developing Model Context Protocol (MCP) servers in C#.

github/awesome-copilot · 21 tokens

C#/.NET Janitor

Perform janitorial tasks on C#/.NET code including cleanup, modernization, and tech debt remediation.

github/awesome-copilot · 27 tokens

template-engine

Expert agent for .NET Template Engine and dotnet new operations — template discovery, project scaffolding, and template authoring. Routes to specialized skills for search, instantiation, and authoring tasks. Verifies template-engine domain relevance before deep-diving.

dotnet/skills · 54 tokens

csharp-quality

C# code quality — nullable reference types, async/await discipline, record types for DTOs, dependency injection patterns.

bdfinst/agentic-dev-team · 27 tokens