skills.rest
Trossitec
TrossitecOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-scan

Scan .NET applications for vulnerabilities and generate severity-rated OWASP findings.

1|Updated Apr 28, 2026
Search Tags:#authorization#security#owasp#data protection#vulnerability scan#cors#secrets detection
One-click install
npx skills add https://github.com/Trossitec/dotnet-claude-kit --skill security-scan-trossitec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/Trossitec/dotnet-claude-kit/tree/main/skills/security-scan
Command: npx skills add https://github.com/Trossitec/dotnet-claude-kit --skill security-scan-trossitec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security scanning prevents .NET teams from shipping applications with known vulnerabilities, hardcoded secrets, unsafe OWASP patterns, weak auth, risky CORS settings, and mishandled sensitive data by producing a severity-rated report with concrete remediation.

Core Features & Use Cases

  • Six-layer vulnerability coverage: Scans vulnerable NuGet packages, detects hardcoded secrets, checks OWASP Top 10 code patterns, reviews authentication/authorization configuration, validates CORS policy, and audits data protection practices.
  • Actionable, remediation-ready findings: Each issue includes severity, file/line context, mapped OWASP category, impact, and specific before/after fixes.
  • Exploitability-focused prioritization: Orders findings by urgency (exploitability, impact, exposure) to help teams address the most dangerous issues first.
  • Use Case: Before a release or after a major dependency upgrade, run a security posture review to catch common static issues like SQL injection, missing [Authorize], overly permissive CORS, exposed PII in logs, and unencrypted sensitive storage.

Quick Start

Use the skill to run a full security audit by asking the AI to perform a “security scan” and return a severity-rated report with remediation steps.

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a static security scan on a .NET application?▼

A static security scan analyzes your .NET codebase across six vulnerability layers—vulnerable packages, secrets, OWASP patterns, auth config, CORS, and data protection—returning a severity-rated report with evidence and remediation steps.

What does an OWASP code pattern review check in .NET?▼

An OWASP code pattern review checks your .NET application for static issues like SQL injection and missing authorization attributes, mapping each finding to an OWASP category with file and line evidence for targeted remediation.

How do I detect hardcoded secrets in my .NET codebase?▼

Detect hardcoded secrets by running a security scan that inspects your .NET codebase for exposed credentials, returning findings prioritized by exploitability and impact with specific secure configuration recommendations.

Can I check CORS policy configuration for .NET applications?▼

Yes, you can check CORS policy configuration by running a security scan that validates your .NET application's CORS settings for overly permissive policies, providing before and after fixes to remediate risks.

What is the best way to audit NuGet packages for known vulnerabilities?▼

The best way to audit NuGet packages is running a security scan that identifies vulnerable dependencies in your .NET application and orders them by urgency based on exploitability, impact, and exposure.

When should I use an automated security review for .NET?▼

Use an automated security review before a release or after a major dependency upgrade to catch static issues like exposed PII, unencrypted storage, and weak authentication in your .NET application.

Related Skills

Explore More Software Engineering Skills→
managedcodemanagedcode
466

dotnet-roslynator

Integrate Roslynator analyzers into .NET C# projects via .editorconfig.

Official
Intermediate
s205109s205109
2

cck-security-scan

Scan .NET codebases for vulnerabilities across packages, secrets, auth, CORS, and PII leaks.

Community
Advanced
HomericIntelligenceHomericIntelligence
18

scan-vulnerabilities

Scan code and dependencies for security vulnerabilities using Bandit, Safety, and Semgrep.

Official
Intermediate
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced