Borrowing it
Nothing to install: this file belongs to frankbolero/dotnet-dump-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/frankbolero/dotnet-dump-mcp/main/.claude/skills/dndump/SKILL.mdgit clone --depth 1 https://github.com/frankbolero/dotnet-dump-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/frankbolero/dotnet-dump-mcp/dndump)<a href="https://agentmods.dev/skills/frankbolero/dotnet-dump-mcp/dndump"><img src="https://agentmods.dev/badge/skills/frankbolero/dotnet-dump-mcp/dndump/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/frankbolero/dotnet-dump-mcp/dndump"><img src="https://agentmods.dev/badge/skills/frankbolero/dotnet-dump-mcp/dndump.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 136 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium MCP Rug Pull · line 144 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
- medium MCP Rug Pull · line 159 Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.Fix: Pin the image: image:tag or image@sha256:abc123
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00146 | $0.02756 |
| Opus 5 | $0.00073 | $0.01378 |
| Sonnet 5 | $0.00029 | $0.00551 |
| Haiku 4.5 | $0.00015 | $0.00276 |
Grade A, and why
dndump scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dndump — .NET dump analysis CLI
dndump is a per-invocation CLI over ClrMD. Each command starts, prints results, and exits — no
persistent process, no tool-manifest context cost. Prefer it over any MCP-server equivalent
whenever a shell is available.
Filter in the shell, not in your head. A dumpheap on a real dump can be thousands of rows.
Never dump a full unfiltered result into context to eyeball it — use --format json/tsv with
jq/grep/awk, or --limit, so only the rows you actually need cost tokens. See "Piping" below.
Selecting a dump
dndump use /path/to/dump.core # writes .dndump/session.json; validates the dump opens
dndump info # runtime, arch, DAC match, heap/segment/thread counts — always run this first
After use, every later command in the same directory tree needs no --dump. Resolution order:
--dump <path> flag → DNDUMP_PATH env var → .dndump/session.json (searched upward). Each shell
invocation is a fresh process with no inherited env, which is exactly why use exists — set it
once, not per command.
If dndump fails to load the dump locally (wrong OS/architecture for the dump, no local .NET
runtime matching it, or no matching DAC available), see "Docker fallback" below before concluding
the dump is unreadable.
Global options
| Option | Default | Notes |
|---|---|---|
--format md|json|tsv |
md |
json is a stable API contract (envelope {data, pagination}, camelCase, 16-hex addresses) — safe to jq against. tsv is header + tab-separated rows for grep/awk/cut. |
--limit <n> / --offset <n> |
50 / 0 |
Paging on every list command. dumpheap also accepts --top <n> as a friendlier alias for --limit (that command only). |
--sort <field> / --order asc|desc |
per command | Valid fields differ per command — run dndump <command> --help if unsure. |
--quiet |
off | Suppresses the informational header on stderr; doesn't affect stdout data. |
--dump <path>, --dac <path> |
— | Override dump/DAC resolution for one call. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 199 lines · 146 tokens per session scan A faf72c0aa2bd
dndump is a skill published in the GitHub repository frankbolero/dotnet-dump-mcp (12 stars, last pushed yesterday), licensed MIT. It adds 146 tokens to every session and 2,756 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dotnet-performance
Evidence-first performance engineering workflow for coding agents combining portable .NET diagnostics with platform-native profiling, BenchmarkDotNet, application benchmarking, statistical validation, deployment, container, graphics, and GPU procedures.
profiling
Use the free official .NET diagnostics CLI tools for profiling and runtime investigation in .NET repositories. USE FOR: the repo needs performance or runtime profiling for a .NET application; the user asks about slow code, high CPU, GC pressure, allocation growth, exception storms, lock. DO NOT USE FOR: replacing…
roslyn-codelens
Use when working with any .NET / C# code (.cs/.csproj/.sln/.slnx files), finding callers/references/implementations, checking compiler errors or warnings, running dotnet build for diagnostics, searching for a type/method/interface by name, inspecting DI registrations, detecting dead code or circular dependencies…
cs0618-hunter
Detects and fixes CS0618 obsolete API warnings in .NET builds. The compiler is the authoritative source for what your project actually triggers — it catches transitive obsoletions, overload-resolution surprises, and project-local [Obsolete] attributes that static inspection cannot see. Pair with the repository-pinned…
nuget-diff-analyzer
Post-processes the repository-pinned [email protected] -- diff output into a categorised report (breaking / additive / newly-obsolete) with each finding cross-referenced to the MAF obsolete-API registry.
rider-search
Routing rules for code search in JetBrains Rider projects — use the Rider MCP symbol/reference/file tools instead of Bash grep. Use whenever searching for a symbol, definition, function, variable, type, or finding usages/references in a C#/.NET or Unreal C++ codebase open in Rider.