Claude Skills by AgenticPawan

Reviews compliance-grade access-audit logging — distinct from dotnet-audit-fields' CreatedBy/ModifiedBy change tracking. Flags no append-only log of who viewed sensitive/PII data (not just who changed it), an access log stored in a table the application can UPDATE/DELETE from (defeating tamper-evidence), no query surface for compliance/SOC2/HIPAA audits, and access-log writes done synchronously in the request path instead of via a non-blocking pipeline. Outputs findings with pilot-dotnet audi...

Reviews ASP.NET Core authentication — who the caller is, distinct from dotnet-authorization's permission checks. Flags hand-rolled login endpoints minting tokens with no real IdP, homegrown Identity password flows where an external IdP belongs, weak password/lockout policy, refresh tokens without rotation/expiry, long-lived access tokens, no MFA for privileged accounts, and unthrottled login endpoints. Outputs pilot-dotnet authentication standard IDs.

Enforces permissions-ONLY access control in ASP.NET Core — no [Authorize(Roles=...)] check is ever acceptable, including coarse/admin-area gating; roles exist only as a role-to-permission assignment mechanism. Flags role-based authorization of any kind, missing IAuthorizationRequirement/AuthorizationHandler policies, magic-string policy names, unprotected minimal API routes, ad-hoc ownership checks that should use resource-based AuthorizeAsync, and JWTs embedding permission lists or PII. Outp...

Reviews the BFF pattern — a dedicated API layer aggregating internal services for the Angular client so internal topology never reaches the browser. Flags Angular calling downstream services directly, 1:1 proxy endpoints adding no value, one failing downstream call collapsing an aggregated response, business logic reimplemented in the BFF, and no UI-tuned caching/rate limiting. Outputs pilot-dotnet backend-for-frontend standard IDs.

Reviews ASP.NET Core background/scheduled job design. Flags hand-rolled BackgroundService loops used instead of Hangfire, job schedules (name, cron, enabled) hardcoded in code instead of sourced from a configurable store, an unauthenticated Background Jobs admin controller that lets callers register or trigger arbitrary jobs, non-idempotent job handlers despite Hangfire's at-least-once execution guarantee, and an unprotected Hangfire dashboard. Outputs findings with pilot-dotnet background-jo...

Reviews ASP.NET Core / EF Core caching strategy. Flags IMemoryCache used in horizontally-scaled APIs (cache incoherence), cache-aside code with no stampede guard, missing cache invalidation on writes, missed HybridCache adoption on .NET 9+ (advisory), missing HTTP-level caching (ResponseCache/ETags) on cacheable GET endpoints, and caching mutable tracked EF Core entities instead of DTO snapshots.

Reviews whether resilience policies established elsewhere (dotnet-resilience's Polly retry/circuit-breaker, dotnet-outbox-pattern's idempotent consumers, dotnet-connection-pool-tuning's pool sizing) are actually verified under real fault injection, rather than existing only as configuration nobody has tested. Flags no chaos-testing practice at all, chaos experiments run only in a lab environment never resembling production load, no game-day/scheduled chaos exercise cadence, and chaos findings...

Audits layering in a Domain/Application/Infrastructure/Api Clean Architecture solution. Flags Domain projects referencing infrastructure packages, business logic living in controllers instead of Application handlers, Domain entities leaking through API responses, Application code depending on concrete Infrastructure types, and missing dependency-inversion registration at the composition root. Outputs findings with pilot-dotnet clean-architecture standard IDs.

Reviews ASP.NET Core / C# code for baseline coding-standard violations. Flags disabled or suppressed nullable reference types, sync-over-async blocking calls, exceptions used for control flow or broad swallowed catches, unstructured string-interpolated logging, and scattered IConfiguration reads instead of the Options pattern. Outputs findings with pilot-dotnet coding-standards standard IDs.

Reviews EF Core / ASP.NET Core optimistic-concurrency handling. Flags multi-user-editable entities with no RowVersion/Timestamp concurrency token, unhandled DbUpdateConcurrencyException surfacing as a generic 500 instead of a 409 Conflict, PUT/PATCH endpoints with no ETag/If-Match precondition support, and read-modify-write sequences with no transaction/concurrency guard around them. Outputs findings with pilot-dotnet concurrency standard IDs.

Reviews database connection-pool sizing and exhaustion monitoring — a distinct failure mode from dotnet-resilience's retry/circuit-breaker policies, which handle a connection failing, not a pool running out of connections to hand out in the first place. Flags no explicit Max Pool Size tuned to expected concurrency, no monitoring/alerting on pool exhaustion, connections held open longer than the unit of work requires, and HttpClient/database connections not scoped correctly for the hosting mod...

Hardens ASP.NET Core CORS configuration. Flags AllowAnyOrigin combined with AllowCredentials, wildcard origins used in a production policy instead of a configuration-sourced allow-list, a single global default policy instead of named per-environment policies, missing WithExposedHeaders when the SPA must read custom response headers, and no preflight cache duration causing excess OPTIONS round-trips.

Reviews CQRS/MediatR command-query separation as its own architectural discipline, distinct from dotnet-validation's pipeline-behavior focus. Flags query handlers that mutate state, commands that return large read models instead of an identifier/minimal result, fat handlers mixing orchestration with business logic that belongs in the domain layer, and commands/queries missing a consistent cross-cutting pipeline (logging, validation, transaction) applied uniformly. Outputs findings with pilot-...

Reviews ASP.NET Core / EF Core data protection for PII. Flags PII columns stored in plaintext with no column-level encryption where the data is highly sensitive, soft-delete that never scrubs PII on a GDPR-style erasure request, PII logged in plaintext via structured logging, and entities/columns with no documented data-classification tagging. Ties to dotnet-audit-fields and dotnet-authorization's earlier PII hardening. Outputs findings with pilot-dotnet data-protection standard IDs.

Reviews ASP.NET Core dependency-injection structure for a clean, modular Program.cs. Flags feature registration inlined directly into Program.cs instead of a per-module IServiceCollection extension method, a module reaching into another module's internals, infra bootstrap mixed with feature-module registration with no clear ordering, and module registration duplicated between Program.cs and test host setup. Outputs findings with pilot-dotnet di-modules standard IDs.

Reviews Excel/PDF import-export in ASP.NET Core. Flags commercial-license libraries (EPPlus v5+, QuestPDF) with no licensing note, full-file in-memory loads that should stream, imports aborting on the first bad row instead of collecting per-row errors, uploads trusted by extension instead of magic bytes, no antivirus scan before durable storage, and duplicated PDF layout logic. Outputs pilot-dotnet document-io standard IDs.

Reviews the boundary between EF Core entities and API contracts. Flags EF entities returned/bound directly through controllers or GraphQL instead of dedicated DTOs, hand-rolled field-by-field mapping duplicated across handlers instead of one AutoMapper/Mapster profile, mapping profiles with no unit test asserting every DTO member is covered, and DTOs that eagerly include navigation-property graphs the caller never asked for. Outputs findings with pilot-dotnet dto-mapping standard IDs.

Reviews where ASP.NET Core configuration values live. Flags business-tunable settings hardcoded in appsettings.json instead of a DB-backed configuration source, secrets stored in the DB config table instead of Key Vault, undocumented precedence between bootstrap appsettings.json and DB-backed values, DB config read on every request with no caching/invalidation, and no admin surface to edit DB config. Outputs findings with pilot-dotnet dynamic-configuration standard IDs.

Reviews transactional email sending in ASP.NET Core APIs. Flags email logic scattered inline instead of behind an IEmailSender abstraction, synchronous send-in-request-path blocking on external providers, duplicated HTML template branding instead of a shared layout, missing retry/backoff around transient provider failures, missing plain-text fallback parts, and unencoded user data interpolated into HTML templates (injection risk). Outputs findings with pilot-dotnet email-service standard IDs.

Reviews EF Core entity primary-key design. Flags integer identity keys on public-facing entities (ID enumeration/IDOR risk), random (v4) GUIDs used for high-insert-volume clustered-index tables instead of sequential/v7-style GUIDs, missing sequential-GUID configuration in OnModelCreating for SQL Server, and sensitive entities that expose their raw database identifier as the public API resource ID with no opaque layer. Outputs findings with pilot-dotnet entity-keys standard IDs.

Reviews ASP.NET Core error-handling architecture. Flags missing centralized exception-handling middleware (IExceptionHandler), error responses that don't follow the RFC 7807 ProblemDetails shape, exception detail (stack traces, messages) leaked to clients in production, and business/domain-rule failures thrown as generic exceptions instead of typed domain exceptions mapped to specific ProblemDetails types. Outputs findings with pilot-dotnet error-handling standard IDs.

Reviews ASP.NET Core feature-flag usage via Microsoft.FeatureManagement — the rollout-specific extension of dotnet-dynamic-configuration's generic DB-backed settings model. Flags feature branching done with ad-hoc if/config checks instead of IFeatureManager, no targeting-filter support for percentage rollout or user/tenant allow-lists, flags left in code long after a rollout completed, and flag evaluation results not exposed to the Angular frontend consistently. Outputs findings with pilot-do...

Reviews numeric-type and rounding discipline for money/pricing/billing code. Flags double or float used for currency amounts instead of decimal, no documented rounding-mode convention (banker's vs away-from-zero) applied inconsistently across calculations, currency amounts compared with equality instead of a tolerance-free decimal comparison, and multi-currency amounts stored/summed without a currency-code alongside the numeric value. Outputs findings with pilot-dotnet financial-precision sta...

Reviews HotChocolate GraphQL API design for shops using GraphQL instead of (or alongside) REST. Flags resolver-level N+1 query patterns with no DataLoader batching, no query-depth or complexity limit letting a single query become a DoS vector, field-level authorization done with role checks instead of the permissions-only model, and no persisted-query/allow-list policy for a public-facing endpoint. Outputs findings with pilot-dotnet graphql standard IDs.

Reviews gRPC service-to-service communication in ASP.NET Core (Grpc.AspNetCore, Grpc.Net.Client) — contract versioning via .proto, streaming, interceptors, deadlines, and transport security. Flags missing client deadlines, breaking .proto field-number changes, no retry/resilience policy for transient failures, unredacted sensitive data logged via interceptors, plaintext internal traffic with no mTLS, and streaming calls with no cancellation wired to client disconnect. Outputs findings with pi...

Reviews ASP.NET Core health check middleware (Microsoft.Extensions.Diagnostics.HealthChecks) that feeds Kubernetes/AKS/ACA/App Service liveness and readiness probes. Flags missing health endpoints, liveness/readiness conflation causing unnecessary pod restarts, checks that don't actually verify the dependency, expensive checks run on every probe hit, unauthenticated endpoints leaking dependency details, and probe config wired to the wrong path. Outputs findings with pilot-dotnet health-checks...

Reviews idempotency for synchronous client-facing APIs — distinct from dotnet-outbox-pattern's async consumer idempotency. Flags state-changing POST/PATCH endpoints accepting no Idempotency-Key, idempotency stores with no expiry, replayed duplicates returning fresh results instead of the original response, and concurrent duplicates racing past the check. Outputs pilot-dotnet idempotency standard IDs.

Reviews ASP.NET Core localization architecture. Flags a resx/XML-only translation layer with no DB-override, an IStringLocalizer implementation that doesn't fall back to XML defaults when no DB row exists, a DB localization table missing a unique (Key, Culture) constraint or caching, ad-hoc per-controller culture resolution instead of RequestLocalizationOptions, and missing-key values silently rendering blank. Outputs findings with pilot-dotnet localization standard IDs.

Reviews ASP.NET Core logging architecture as distinct from dotnet-observability's tracing/health-check focus. Flags no centralized logging abstraction/sink configuration (Console-only in production), no environment-gated log-level policy, log enrichers missing correlation ID/environment/version context, PII/secrets logged in message arguments, and high-volume endpoints with no sampling strategy driving up ingestion cost. Outputs findings with pilot-dotnet logging standard IDs.

Reviews Service Bus/Event Grid topology and consumer design beyond dotnet-outbox-pattern's atomic publish. Flags no message schema versioning, competing-consumer concurrency breaking required ordering, payloads embedding full domain entities instead of minimal versioned contracts, queue-vs-topic mismatched to fan-out, and no correlation/trace context in envelopes. Outputs pilot-dotnet messaging standard IDs.

Reviews ASP.NET Core middleware ordering in Program.cs. Flags exception handler/HSTS registered too late, CORS after auth breaking Angular preflights, authorization before authentication, rate limiting after expensive work, static files before authentication, and no enforced ordering a refactor can't silently break. Outputs pilot-dotnet middleware-pipeline standard IDs.

Reviews Minimal APIs vs MVC Controllers usage. Flags no team convention for endpoint style, fat inline lambdas holding business logic, cross-cutting concerns re-implemented per endpoint instead of IEndpointFilter/route groups, missing typed results breaking OpenAPI, no MapGroup strategy, and no migration path between styles. Outputs pilot-dotnet minimal-api-governance standard IDs.

Reviews multi-tenancy at the ASP.NET Core API/application layer — tenant resolution, DI lifetime correctness, and connection-routing for both shared-database and database-per-tenant models. Flags ad-hoc per-endpoint tenant resolution instead of centralized middleware, Singleton-scoped tenant context leaking across requests, stale per-request connection strings, missing tenant catalog caching, and silent fallback on unresolved tenants. Cross-references pilot-sql's sql-multitenancy skill for EF...

Reviews SMS/push notification delivery, distinct from dotnet-email-service's email scope. Flags provider SDKs called directly instead of behind INotificationSender, synchronous sends blocking the request path, no retry/backoff, per-channel opt-out with no shared preference store, no delivery-status tracking, and PII in visible push payloads. Outputs pilot-dotnet notifications standard IDs.

Reviews .NET package hygiene distinct from pilot-core's dependency-supply-chain policy. Flags no Central Package Management in multi-project solutions, inconsistent PackageReference versions, no packages.lock.json for deterministic restores, deprecated packages with no replacement plan, and multi-target incompatibilities. Outputs pilot-dotnet nuget-governance standard IDs.

Reviews ASP.NET Core observability setup. Flags missing /health/live and /health/ready endpoints needed for Kubernetes/Azure Container Apps rolling deployments, missing OpenTelemetry tracing/metrics wiring, correlation IDs not attached to distributed traces, readiness checks that don't distinguish liveness from real dependency health, and high-cardinality/PII data logged as trace attributes without redaction. Outputs findings with pilot-dotnet observability standard IDs.

Audits and generates versioned OpenAPI specs in ASP.NET Core: spec format, ProblemDetails response types on error routes, versioned document endpoints, Swashbuckle/NSwag configuration, security scheme declarations (Bearer/OAuth2), XML doc comment wiring, and breaking-change awareness. Aligns with API versioning conventions from dotnet-api-versioning.

Reviews distributed-messaging conventions once a Clean Architecture solution starts publishing domain events to Service Bus/Event Grid. Flags a message published directly inside the same transaction as the business write with no transactional outbox, message consumers that aren't idempotent despite at-least-once delivery, no dead-letter handling for poison messages, and outbox rows never cleaned up after successful publish. Outputs findings with pilot-dotnet outbox-pattern standard IDs.

Reviews ASP.NET Core and EF Core code for runtime performance regressions: sync-over-async blocking that starves the thread pool, ValueTask/Task misuse in hot paths, large in-memory materialization instead of streaming with IAsyncEnumerable, minimal API vs MVC controller overhead, missing response compression for large JSON payloads, and string concatenation in loops instead of StringBuilder/string.Create.

Reviews ASP.NET Core rate-limiting coverage. Flags login/auth endpoints with no rate limiting (brute-force/credential-stuffing exposure), the background-jobs admin controller lacking a rate limit on its trigger endpoint, no application-layer AddRateLimiter baseline for public APIs, and rate-limit rejections that omit a Retry-After header. Outputs findings with pilot-dotnet rate-limiting standard IDs.

Reviews ASP.NET Core real-time/streaming patterns — SignalR hubs and server-sent/IAsyncEnumerable streaming responses. Flags SignalR hubs with role-based or missing authorization instead of the permissions-only model, no backplane configured for multi-instance scale-out, streaming endpoints that buffer the full result before writing instead of yielding incrementally, and no client-side reconnection/backoff policy. Outputs findings with pilot-dotnet realtime standard IDs.

Reviews scheduled reporting and batch/ETL pipelines — distinct from dotnet-document-io's on-request exports. Flags batch jobs run inline in web requests, full-table in-memory reads, ETL with no idempotency/checkpoints, hardcoded recipients/schedules, no alerting on silent failures, and report queries hitting OLTP with no replica separation. Outputs pilot-dotnet reporting-etl standard IDs.

Reviews when and how the repository pattern should sit over EF Core — flags interfaces that leak IQueryable<T> to callers, generic IRepository<T> wrappers with no added value over DbContext.Set<T>(), missing Unit of Work coordination across multiple repositories, absent Specification pattern for reusable complex queries, and repository method names that leak SQL-specific concepts. Outputs findings with pilot-dotnet repository-pattern standard IDs.

Reviews outbound HTTP resilience — the backend counterpart to angular-http-resilience. Flags raw HttpClient instead of IHttpClientFactory/typed clients, missing Polly retry/backoff, no circuit breaker on failure-prone dependencies, missing per-request timeouts, correlation IDs not propagated, and EF Core without EnableRetryOnFailure. Outputs pilot-dotnet resilience standard IDs.

Reviews distributed-transaction design once a business process spans multiple independently-owned services/databases. Flags an ambient/distributed DB transaction attempted across service boundaries with no true coordinator, a saga step that can fail after prior steps committed with no compensating action, saga state kept only in memory instead of persisted, and a choreography-based saga with no shared correlation ID across its event chain. Outputs findings with pilot-dotnet saga-orchestration...

Reviews secret and certificate rotation discipline — the lifecycle layer above dotnet-dynamic-configuration's storage-location rule (Key Vault, not the DB config table). Flags JWT signing keys with no rotation/grace-period overlap, database credentials never rotated on a schedule, certificates with no expiry monitoring/alerting, and rotation events that aren't logged for audit. Outputs findings with pilot-dotnet secrets-rotation standard IDs.

Hardens ASP.NET Core HTTP response security headers and request-binding safety. Flags missing HSTS/Strict-Transport-Security, missing X-Content-Type-Options, missing clickjacking protection (X-Frame-Options/frame-ancestors), anti-forgery/CSRF tokens absent on cookie-authenticated state-changing endpoints, permissive polymorphic JSON deserialization of untrusted input, and request models bound directly to EF entities (mass-assignment/over-posting).

Reviews internal shared/common class libraries (e.g. Company.Shared) for structure and string-extension conventions — flags ad-hoc string extensions scattered outside a central StringExtensions class, missing null-guards on extension "this" parameters, god-utility libraries mixing unrelated concerns, informal versioning via copy-paste or cross-solution ProjectReference instead of a versioned NuGet package, and duplicated utility logic reimplemented per-project. Outputs findings with pilot-dot...

Reviews the EF Core soft-delete pattern in ASP.NET Core apps. Flags soft-deletable entities missing a global query filter, direct DbContext.Remove() calls that bypass a hard-to-soft-delete interceptor, unique indexes not filtered to exclude deleted rows, un-cascaded soft deletes that orphan active children, and missing DeletedBy/DeletedAt audit pairs. Outputs findings with pilot-dotnet soft-delete standard IDs; cross-references the dotnet-audit-fields skill for the general audit-trail pattern.

Reviews C# for SOLID/DRY violations: god services (SRP), type-switch chains (OCP), substitutability breaks via NotImplementedException (LSP), fat interfaces (ISP), high-level services constructing concrete dependencies (DIP), and duplicated logic/magic values (DRY). Outputs pilot-dotnet solid-dry standard IDs.