Claude Skills by AgenticPawan

Reviews fail-fast configuration validation at startup so misconfiguration surfaces at boot, not first request. Flags options with no IValidateOptions/data-annotation validation, missing ValidateOnStart(), no startup reachability checks for required dependencies, no environment schema-parity check, secrets logged during startup, and no smoke test before traffic routing. Outputs pilot-dotnet startup-validation standard IDs.

Reviews ASP.NET Core test suite architecture. Flags hand-rolled WebApplicationFactory setup duplicated per test class instead of a shared fixture/collection, integration tests run against a mocked DbContext or EF Core's in-memory provider instead of a real SQL Server instance via Testcontainers, ad-hoc test data literals scattered per test instead of shared builders, and an undocumented policy for what gets faked versus what must be real in test doubles. Outputs findings with pilot-dotnet tes...

Reviews ASP.NET Core request validation strategy. Flags inconsistent validation approaches across endpoints (mixing data annotations and ad-hoc checks with no house convention), validation logic duplicated between the endpoint and its Application-layer handler instead of one pipeline behavior, validation failures not shaped as ProblemDetails, and cross-field/business validation run inline in a controller instead of an independently testable validator. Outputs findings with pilot-dotnet valida...

Reviews outbound webhook delivery to third-party subscribers in ASP.NET Core — distinct from dotnet-outbox-pattern's internal domain-event messaging. Flags payloads sent with no HMAC signature, no retry/backoff policy for a failing subscriber endpoint, no delivery-attempt log or dead-letter handling for a permanently-down subscriber, no replay-attack protection, subscriber-provided callback URLs not validated against SSRF, and no way for a subscriber to rotate their signing secret without dow...

Governs self-hosted reverse-proxy gateways built with YARP (Yet Another Reverse Proxy). Covers tenant routing, header propagation, rate limits at the edge, observability wiring, and the decision boundary between YARP and Azure API Management or the Backend-for-Frontend pattern.

Scaffold a local, provider-agnostic RAG system into ./pilot-rag/ that answers questions about your own Angular/.NET/SQL/Azure codebase.

Phase 3 of the pilot-rag scaffold. Implements the RagPilot.Ingestion pipeline — the five IChunker strategies (CSharpChunker via Roslyn, TypeScriptChunker via regex/brace, MarkdownChunker, OpenApiChunker, ConfigChunker with redaction), the Qdrant ragpilot_chunks schema, deterministic-UUID idempotency (skip unchanged, delete removed), and embedding/upsert batching. Use for /fsp-rag-init Phase 3.

Phase 0 of the pilot-rag scaffold. Scans the target application repo (the current project, read-only) and produces pilot-rag/INGESTION_MANIFEST.md — a classified inventory of ingestible sources with per-type file counts, token estimates, chunking-strategy assignments, include/exclude rationale, secret-redaction rules applied at ingestion time, and a "Known blind spots" section. Use when running /fsp-rag-init Phase 0, or when the user asks to build the ingestion manifest / discover what a RAG ...

Phase 6 of the pilot-rag scaffold. Builds the eval harness and provider-swap proof — eval/questions.json (20 questions from the actual manifest, each with an expectedFilePath), an xUnit Eval-category runner asserting retrieval hit-rate >= 80% (tune, never lower the bar), and a network-free test asserting the Azure OpenAI provider resolves a non-null IChatClient. Use for /fsp-rag-init Phase 6.

Cost/safety guardrails for the pilot-rag generation path — bounds /ask and ingestion token spend and runaway output. Covers per-request token/cost ceilings (output cap + context budget), embedding-cost control on ingestion, output validation and bounded provider-failure handling, and token/cost observability. Complements rag-security; matters most once the Ollama->Azure OpenAI swap points it at a metered provider.

Phase 2 of the pilot-rag scaffold. Builds the RagPilot.sln skeleton (Core/Ingestion/Api/Tests) and the provider-abstraction layer — a single static factory mapping appsettings to Microsoft.Extensions.AI IChatClient + IEmbeddingGenerator, with an architecture test asserting RagPilot.Core references no vendor SDK. Enforces the core rule: swapping Ollama<->Azure OpenAI is appsettings-only, zero code changes. Use for /fsp-rag-init Phase 2.

Phase 4 of the pilot-rag scaffold. Builds the RagPilot.Api /ask SSE endpoint and RagPilot.Core retrieval loop — embed question, Qdrant topK search with heuristic sourceType filtering, a 0.35 cosine score floor with a fixed not-found answer (model forbidden off-corpus), a 6000-token prompt budget, streamed tokens, a trailing sources event, plus /health and /index/stats. Use for /fsp-rag-init Phase 4.

Security hardening for the pilot-rag scaffold — governs the live /ask endpoint and Qdrant store other rag skills build. Covers prompt injection via indexed content, /ask authZ + abuse (auth, rate limiting, topK/question caps), PII/secret handling in Qdrant (redaction before embedding, deletion path, no anonymous DB access), and answer/error leakage. Applies across /fsp-rag-init phases 3-5; run as a review at the end.

Reviews backup integrity and restore-drill discipline — distinct from azure-dr-multiregion's cross-region infra replication and sql-index-maintenance's ongoing index health. Flags no scheduled restore-drill verifying a backup is actually restorable, no backup-integrity check (CHECKSUM/RESTORE VERIFYONLY), no documented point-in-time-restore test cadence, and backup retention that doesn't match the RPO documented elsewhere. Outputs findings with pilot-sql backup-recovery standard IDs.

Reviews SQL Server-side protection for PII columns — the database counterpart to dotnet-data-protection's application-layer checks. Flags highly sensitive columns with no Always Encrypted configuration, no Dynamic Data Masking on columns visible to lower-privilege roles, Transparent Data Encryption not verified as enabled, and backups/restores that don't preserve the same encryption and masking guarantees as production. Outputs findings with pilot-sql data-protection standard IDs.

Designs and audits SQL Server data retention and purge policies: temporal table SYSTEM_VERSIONING with retention period, soft-delete with retention date columns, scheduled or partition-switch-based purge jobs, compliance archiving (GDPR right-to-erasure, right-to-be-forgotten), and PII column scrubbing before archive. Ensures purge jobs respect multitenancy isolation.

Reviews database-tier high availability and failover — distinct from sql-backup-recovery's restore drills and azure-dr-multiregion's app/infra replication. Flags a single-instance database behind an SLA that needs HA, a connection string not targeting the AG listener / failover-group endpoint, read-only workloads not routed to a readable secondary, no documented data-tier RPO/RTO, and failover never actually tested. Outputs pilot-sql sql-hadr-failover standard IDs.

Reviews ongoing SQL Server index/statistics maintenance as an operational concern distinct from sql-performance-review's query-level analysis. Flags no scheduled job rebuilding/reorganizing fragmented indexes, no statistics-update cadence for tables with volatile data, no monitoring for unused indexes accumulating write overhead, and no maintenance-window awareness for online vs offline index operations. Outputs findings with pilot-sql index-maintenance standard IDs.

Detects SQL injection risks in .NET + EF Core: flags FromSqlRaw with non-static string arguments, distinguishes safe FromSqlInterpolated from concatenated queries, reviews stored procedure EXEC patterns for dynamic SQL, and checks Dapper query strings for parameter hygiene. Maps all findings to CWE-89 / OWASP A03:2021 and emits them in the /fsp-audit findings schema. Defers query-optimization decisions to the dotnet-data plugin.

Reviews EF Core migration files before deployment: detects destructive operations (DROP COLUMN, DROP TABLE, column type narrowing, NOT NULL constraint on existing data), flags table-locking DDL on tables that should use online-safe patterns (add-nullable-then-backfill), verifies rollback scripts or reversible Down() implementations, and cross-checks migration intent against the current model snapshot. Outputs findings with sql-migration-safety standard IDs.

Audits EF Core tenant isolation at the data layer: verifies HasQueryFilter is applied to every entity with TenantId or OrgId, flags IgnoreQueryFilters calls without a justification comment, generates a cross-tenant test scaffold asserting Tenant A cannot read Tenant B's rows, and documents SQL Server row-level security as a defence-in-depth option. Outputs findings with pilot-sql multitenancy standard IDs.

Reviews .NET + EF Core query patterns for SQL Server performance: detects non-SARGable predicates (function on indexed column, implicit type conversion), identifies N+1 load patterns, flags missing AsNoTracking on read-only paths, recommends covering index columns from WHERE/ORDER patterns, and reads execution plans via the sql-mcp MCP server when available. Defers EF Core query-optimization implementation to the dotnet-data plugin skill.

Reviews foundational SQL Server schema design before migration-safety, performance, or injection-defense checks even apply. Flags inconsistent table/column naming conventions, an undocumented surrogate-vs-natural key strategy, missing foreign key constraints enforced only in application code, missing NOT NULL/CHECK constraints on columns with a bounded business domain, stored procedures/views not checked into source control, and unbounded NVARCHAR(MAX) columns on well-known bounded domains. O...

Reviews SQL Server change-capture — the data-side foundation dotnet-outbox-pattern, dotnet-audit-trail, and zero-downtime-deployment assume. Flags audit history via hand-rolled triggers/shadow tables instead of system-versioned temporal tables, CDC/Change Tracking with no cleanup/retention, downstream sync polling timestamp columns instead of Change Tracking/CDC, temporal history not covered by tenant filters or retention, and CDC capture instances not refreshed after a schema change. Outputs...

Reviews automated testing of T-SQL logic that lives in the database — the one testing surface dotnet-testing and angular-testing don't reach. Flags stored procedures, functions, and triggers carrying business logic with no tSQLt test, tests that hit real tables instead of tSQLt FakeTable/SpyProcedure isolation, T-SQL tests not wired into CI, error/RAISERROR paths with no assertion (happy-path-only), and per-test data setup duplicated instead of a shared fixture. Outputs pilot-sql standard IDs...