dotnet-init

A setup guide for connecting dotnet-toolkit, a set of tools for working with .NET projects, to a project and teaching the agent how to use it.

In plain words
What is it for?
Setting up, checking, refreshing, or removing dotnet-toolkit in a repository, while adding its guidance to project rules with approval.
Why use it?
It prevents a newly opened session from using unsuitable file-search methods for C# and makes the project’s tool guidance explicit. It also checks whether the connection is working.

Skill for Claude CodeCodex

Part of the dotnet-toolkit plugin — 9 skills, 6 agents, 2 hooks, 1 MCP server shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/attemainio/dotnet-toolkit/dotnet-init
Any agent
npx skills add Attemainio/dotnet-toolkit --skill dotnet-init
Clone the repo
git clone --depth 1 https://github.com/Attemainio/dotnet-toolkit

Made for: Claude Code, Codex.

Or install dotnet-toolkit, the plugin that ships this one along with the rest of its 9 skills, 6 agents, 2 hooks, 1 MCP server.

Per session 257 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,756 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00257 $0.01756
Opus 5 $0.00129 $0.00878
Sonnet 5 $0.00051 $0.00351
Haiku 4.5 $0.00026 $0.00176

Measured 2d ago against content hash 4f263a7dd34b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

dotnet-init scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Subtle steeringmediumPrompt injection

Instructions that bias recommendations or shape behaviour without the user noticing.

*alongside* CLAUDE.md at the same priority — never tell the user they "override" anything. Actual
skills/dotnet-init/SKILL.md · 99 lines

How it starts

The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Wiring dotnet-toolkit into a project

Installing this plugin (/plugin install, or --plugin-dir) makes its MCP tools available. It does not make Claude prefer them — nothing tells a fresh session in a consuming repo that Grep and Read give wrong answers on C#, or that validate_patch is the write path, or that the plugin ships coding standards at all. A plugin cannot ship a .claude/rules/ file the harness auto-loads; only a repo's own .claude/rules/ gets scanned, and a plugin has no manifest field to register one. This skill writes that guidance into a target repo, additively, and only with explicit approval.

This skill does not touch the repo's CLAUDE.md. Per Claude Code's documentation (code.claude.com/docs/en/memory), .claude/rules/ is discovered and loaded independently of CLAUDE.md — rules are not appended into that file at runtime, they are a separate context injection. The project's own CLAUDE.md — its architecture, commands, and conventions, written and owned by the project — is left alone entirely.

Be honest with the user about the loading mechanics. A paths:-scoped rule fires only when the built-in Read touches a matching file — and here .cs contact goes through the MCP tools or is blocked by the guards, so paths: ["**/*.cs"] would almost never load. Worse, it does not reliably suppress either: the read guard deliberately allows Read on .cs files no project compiles, so such a rule fires unpredictably rather than on demand. (Earlier versions of this skill shipped standards as path-scoped rules for exactly this reason, and it was wrong both ways.)

So: one file is copied, dotnet-index.md, carrying no paths: and therefore always-loaded — which is why it is kept short. It costs tokens in every session, and is inherited by every subagent with no opt-out, so a parallel review pays it once per instance. The coding standards are not copied at all: they live at ${CLAUDE_PLUGIN_ROOT}/standards/ and are read by explicit path, so a consuming repo is always on the current versions and has nothing to refresh. Rules load alongside CLAUDE.md at the same priority — never tell the user they "override" anything. Actual enforcement is the plugin's PreToolUse hooks, which travel with the plugin and need no per-repo setup.

Do not skip the approval step under any circumstances, even if the user's request sounded like a green light to "just do it." These files change how every future session in that repo behaves; show the exact content and wait for a yes.

Read the full file on GitHub · 99 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 99 lines · 257 tokens per session scan B 4f263a7dd34b

Subscribe to this mod's changes

dotnet-init is a skill published in the GitHub repository Attemainio/dotnet-toolkit (2 stars, last pushed 6d ago), licensed MIT. It adds 257 tokens to every session and 1,756 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it B with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

vela

Compiler-exact code search for .NET solutions - find where a symbol is defined, every reference to it, who calls it, and what a change would break. Covers C#, VB, Razor Pages, MVC views and Blazor components, which grep and every other code-intelligence tool miss. Deterministic, built on Roslyn, never modifies the…

dbhq-uk/vela-skill · 164 tokens

dpg-migration

Migration logic for Azure SDK for .NET data-plane libraries migrating from AutoRest/Swagger to TypeSpec-based generation. Uses MCP tools from the generator-agent server for automated deterministic fixes.

Azure/azure-sdk-for-net · 41 tokens

csharp-azure-spector-coverage-gaps

Discovers and implements gaps in Spector test coverage for the Azure C# HTTP client emitter. Use when asked to find missing Spector scenarios, add Spector test coverage, or implement a specific Spector spec for the Azure C# emitter. Can also compare coverage between the Azure dashboard and the Standard (TypeSpec core)…

Azure/azure-sdk-for-net · 78 tokens

mgmt-review-comment-resolution

Resolve review comments on Azure management-plane .NET SDK PRs. Handles renaming types/properties, changing property types, and other API surface adjustments by updating TypeSpec client.tsp and regenerating.

Azure/azure-sdk-for-net · 46 tokens

mpg-migration

Handles Azure SDK for .NET management-plane migrations from AutoRest/Swagger to TypeSpec; use for MPG, mgmt migration, or Azure.ResourceManager. migration requests.

Azure/azure-sdk-for-net · 39 tokens

bump-mgmt-base-version

Bump the http-client-csharp base dependency version in http-client-csharp-mgmt. Updates emitter (npm) and generator (NuGet) references, rebuilds, and regenerates test projects.

Azure/azure-sdk-for-net · 47 tokens