security-scan

Scan .NET applications for security weaknesses with severity-rated findings.

224|87|Updated Dec 15, 2018
One-click install
npx skills add https://github.com/Resgrid/Core --skill security-scan-resgrid
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/Resgrid/Core/tree/main/.opencode/skills/security-scan
Command: npx skills add https://github.com/Resgrid/Core --skill security-scan-resgrid

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you identify common security weaknesses in .NET applications early by scanning dependencies, source code, configuration, authentication/authorization, CORS, and sensitive data handling.

Core Features & Use Cases

  • Six-layer .NET security scan: Detect vulnerable packages, hardcoded secrets, OWASP Top 10 code patterns, auth misconfiguration, risky CORS policies, and data protection issues.
  • Actionable severity-rated findings: Produce findings with severity, where it occurs, why it matters, impact, and specific remediation steps (including before/after code patterns).
  • Security-review workflows: Use it for pre-release security gates, after dependency updates, before penetration tests, or as a quarterly security review checklist.

Quick Start

Use the security-scan skill to run a six-layer scan that reports severity-rated .NET vulnerabilities and includes concrete remediation guidance.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan .NET applications for hardcoded secrets and OWASP Top 10 vulnerabilities?

Scanning .NET applications for hardcoded secrets and OWASP Top 10 vulnerabilities involves running a static analysis security scan. It reviews dependencies, configuration, and source code to output severity-rated findings with remediation steps.

Can I use this to check for vulnerable NuGet packages and CVE scanning before a release?

Yes, checking for vulnerable packages and performing CVE scanning is supported as a pre-release security gate. The scan identifies known vulnerable dependencies and provides actionable remediation guidance mapped to OWASP categories.

What is the best way to review CORS policy and authentication configuration in .NET?

Reviewing CORS policy and authentication configuration in .NET is best done through a targeted static security scan. It identifies risky CORS policies and auth misconfigurations, detailing the security impact and specific remediation steps.

Does static analysis replace penetration testing for finding security weaknesses?

Static analysis does not replace penetration testing. This scan explicitly identifies known static risks in code and configuration to reduce vulnerabilities before you move to dynamic penetration testing.

When do I need to run a .NET security scan for sensitive data protection?

You need to run a .NET security scan for sensitive data protection during pre-release gates, after dependency updates, or before penetration tests. It detects data protection issues and outputs severity-rated findings with remediation guidance.