Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/attemainio/dotnet-toolkit/dotnet-initnpx skills add Attemainio/dotnet-toolkit --skill dotnet-initgit clone --depth 1 https://github.com/Attemainio/dotnet-toolkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00257 | $0.01756 |
| Opus 5 | $0.00129 | $0.00878 |
| Sonnet 5 | $0.00051 | $0.00351 |
| Haiku 4.5 | $0.00026 | $0.00176 |
Grade B, and why
dotnet-init scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
*alongside* CLAUDE.md at the same priority — never tell the user they "override" anything. Actual How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Wiring dotnet-toolkit into a project
Installing this plugin (/plugin install, or --plugin-dir) makes its MCP tools available. It does
not make Claude prefer them — nothing tells a fresh session in a consuming repo that Grep and Read give
wrong answers on C#, or that validate_patch is the write path, or that the plugin ships coding
standards at all. A plugin cannot ship a .claude/rules/ file the harness auto-loads; only a repo's own
.claude/rules/ gets scanned, and a plugin has no manifest field to register one. This skill writes that
guidance into a target repo, additively, and only with explicit approval.
This skill does not touch the repo's CLAUDE.md. Per Claude Code's documentation
(code.claude.com/docs/en/memory), .claude/rules/ is discovered and loaded independently of CLAUDE.md —
rules are not appended into that file at runtime, they are a separate context injection. The project's
own CLAUDE.md — its architecture, commands, and conventions, written and owned by the project — is left
alone entirely.
Be honest with the user about the loading mechanics. A paths:-scoped rule fires only when the
built-in Read touches a matching file — and here .cs contact goes through the MCP tools or is
blocked by the guards, so paths: ["**/*.cs"] would almost never load. Worse, it does not reliably
suppress either: the read guard deliberately allows Read on .cs files no project compiles, so
such a rule fires unpredictably rather than on demand. (Earlier versions of this skill shipped
standards as path-scoped rules for exactly this reason, and it was wrong both ways.)
So: one file is copied, dotnet-index.md, carrying no paths: and therefore always-loaded —
which is why it is kept short. It costs tokens in every session, and is inherited by every
subagent with no opt-out, so a parallel review pays it once per instance. The coding standards
are not copied at all: they live at ${CLAUDE_PLUGIN_ROOT}/standards/ and are read by explicit
path, so a consuming repo is always on the current versions and has nothing to refresh. Rules load
alongside CLAUDE.md at the same priority — never tell the user they "override" anything. Actual
enforcement is the plugin's PreToolUse hooks, which travel with the plugin and need no per-repo
setup.
Do not skip the approval step under any circumstances, even if the user's request sounded like a green light to "just do it." These files change how every future session in that repo behaves; show the exact content and wait for a yes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 99 lines · 257 tokens per session scan B 4f263a7dd34b
dotnet-init is a skill published in the GitHub repository Attemainio/dotnet-toolkit (2 stars, last pushed 6d ago), licensed MIT. It adds 257 tokens to every session and 1,756 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it B with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
vela
Compiler-exact code search for .NET solutions - find where a symbol is defined, every reference to it, who calls it, and what a change would break. Covers C#, VB, Razor Pages, MVC views and Blazor components, which grep and every other code-intelligence tool miss. Deterministic, built on Roslyn, never modifies the…
dpg-migration
Migration logic for Azure SDK for .NET data-plane libraries migrating from AutoRest/Swagger to TypeSpec-based generation. Uses MCP tools from the generator-agent server for automated deterministic fixes.
csharp-azure-spector-coverage-gaps
Discovers and implements gaps in Spector test coverage for the Azure C# HTTP client emitter. Use when asked to find missing Spector scenarios, add Spector test coverage, or implement a specific Spector spec for the Azure C# emitter. Can also compare coverage between the Azure dashboard and the Standard (TypeSpec core)…
mgmt-review-comment-resolution
Resolve review comments on Azure management-plane .NET SDK PRs. Handles renaming types/properties, changing property types, and other API surface adjustments by updating TypeSpec client.tsp and regenerating.
mpg-migration
Handles Azure SDK for .NET management-plane migrations from AutoRest/Swagger to TypeSpec; use for MPG, mgmt migration, or Azure.ResourceManager. migration requests.
bump-mgmt-base-version
Bump the http-client-csharp base dependency version in http-client-csharp-mgmt. Updates emitter (npm) and generator (NuGet) references, rebuilds, and regenerates test projects.