Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fpindej/netrock/backend-conventionsnpx skills add fpindej/netrock --skill backend-conventionsgit clone --depth 1 https://github.com/fpindej/netrockWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fpindej/netrock/backend-conventions)<a href="https://agentmods.dev/skills/fpindej/netrock/backend-conventions"><img src="https://agentmods.dev/badge/skills/fpindej/netrock/backend-conventions.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00027 | $0.03075 |
| Opus 5 | $0.00014 | $0.01537 |
| Sonnet 5 | $0.00005 | $0.00615 |
| Haiku 4.5 | $0.00003 | $0.00308 |
Grade A, and why
backend-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backend Conventions (.NET 10 / C# 13)
Project Structure
src/backend/
├── MyProject.Shared/ # Result, Error, ErrorType, ErrorMessages (zero deps)
├── MyProject.Domain/Entities/ # Business entities (BaseEntity)
├── MyProject.Application/ # Interfaces, DTOs, service contracts
│ ├── Features/{Feature}/I{Feature}Service.cs
│ ├── Features/{Feature}/Dtos/{Operation}Input.cs, {Entity}Output.cs
│ ├── Identity/IUserService.cs, IUserContext.cs
│ └── Identity/Constants/AppRoles.cs, AppPermissions.cs
├── MyProject.Infrastructure/ # Implementations (all internal)
│ ├── Features/{Feature}/Services/, Configurations/, Extensions/
│ └── Persistence/MyProjectDbContext.cs
├── MyProject.ServiceDefaults/ # Aspire shared: OTEL, service discovery, resilience
├── MyProject.AppHost/ # Aspire orchestrator (local dev only)
└── MyProject.WebApi/ # Entry point
├── Features/{Feature}/{Feature}Controller.cs, {Feature}Mapper.cs
├── Features/{Feature}/Dtos/{Operation}/{Operation}Request.cs + Validator
├── Authorization/ # RequirePermission, PermissionPolicyProvider
└── Shared/ # ApiController, ProblemFactory, ValidationConstants
C# Conventions
Access Modifiers
| Item | Modifier |
|---|---|
| Domain entities, Application interfaces/DTOs | public |
| Infrastructure services, EF configs, mappers | internal |
| WebApi controllers, request/response DTOs | public |
Key Rules
- Nullability:
string.Emptyfor required,string?for optional. Express nullability in the type system. - Collections: Prefer
IReadOnlyList<T>on public interfaces. Avoid exposingList<T>orT[]directly. - Time:
TimeProviderregistered asTimeProvider.Systemsingleton. - NuGet: To add a package:
<PackageVersion Include="Pkg" Version="X.Y.Z" />inDirectory.Packages.props,<PackageReference Include="Pkg" />in.csproj.
Entity Definition
New entities should extend BaseEntity (provides Id, CreatedAt/By, UpdatedAt/By, IsDeleted, DeletedAt/By - all set by AuditingInterceptor automatically) and use BaseEntityRepository<T> for data access.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 250 lines · 27 tokens per session scan A 230f223056c8
backend-conventions is a skill published in the GitHub repository fpindej/netrock (231 stars, last pushed 4d ago), licensed MIT. It adds 27 tokens to every session and 3,075 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
clean-architecture-dotnet
Use when domain logic leaks into API/Infrastructure, project references violate layer boundaries, or you need to decide between CQS (always), CQRS bus (complex domains), and DDD patterns (invariants and events).
creating-dotnet-mcp-servers
Use when building Model Context Protocol (MCP) servers in .NET, configuring tools, transports (SSE/stdio), JSON serialization for AOT, or testing MCP endpoints.
update-dependencies
Use when the task in front of you is to move dependency pins — packages in either stack, Rust crates, tools, SDKs, GitHub Action references, or container images — or to find out which of them are behind and whether any changed licence.
python
Enforces FastAPI, Dependency Injection, and general Python coding standards based on the repository structure.
dpg-migration
Migration logic for Azure SDK for .NET data-plane libraries migrating from AutoRest/Swagger to TypeSpec-based generation. Uses MCP tools from the generator-agent server for automated deterministic fixes.
mitigate-breaking-changes
Patterns and techniques for mitigating breaking changes in Azure management-plane SDKs. Covers SDK-side customizations (partial classes, CodeGenType, CodeGenSuppress) and TypeSpec decorator customizations (clientName, access, markAsPageable, alternateType, hierarchyBuilding).