dotnet-onion-api

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

This .NET scaffolder is coherent and not malicious, but its generated API auth and error-handling templates include insecure defaults that users should review before relying on them.

Before installing, treat generated projects as needing security hardening: reject placeholder JWT secrets at startup, require secrets from a secret manager or environment, enable issuer/audience/lifetime validation, and remove stack traces from staging responses. Also confirm the skill should scaffold a new solution before letting it write many files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: references/templates/appsettings.md:14

Finding

Predictable Placeholder JWT Signing Key Is Accepted at Runtime

Content

View full analysis

{ options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuerSigningKey = true, IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret)), ValidateIssuer = false, ValidateAudience = false, }; }); services.AddAuthorization(); return services; } ``` ### Technical Analysis The generated `appsettings.json` contains a public, deterministic placeholder that is used directly as the symmetric HS256 JWT signing key. Runtime validation only checks whether the setting is null; it does not reject the known placeholder or verify that the key came from an external secret provider. Because the placeholder is longer than 32 characters, it can also satisfy the template's `MinLength(32)` options validation. Consequently, a generated application may start successfully with this publicly known signing key if the operator forgets to override it. Anyone with access to the Skill template can reproduce the key and create JWTs with arbitrary identity claims. The generated controllers inherit `[Authorize]`, so a token signed with this ...[truncated 1379 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/templates/program-cs.md:91

Finding

JWT Issuer and Audience Validation Are Disabled

Content

View full analysis

{ options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuerSigningKey = true, IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret)), ValidateIssuer = false, ValidateAudience = false, }; }); services.AddAuthorization(); return services; } ``` ### Technical Analysis JWT signature validation establishes that a token was signed by a party possessing the configured key, but it does not establish that the token was issued by the correct authority or intended for this API. With `ValidateIssuer` and `ValidateAudience` disabled, the generated API accepts any correctly signed token regardless of its `iss` or `aud` claims. This creates a cross-service and cross-environment token replay risk when multiple applications, environments, or token purposes share the same signing key. The weakness is particularly relevant to symmetric signing because every service capable of verifying an HS256 token also possesses the signing key and can produce tokens accepted by other services using that key. ### Attack Path 1. Two services or environments use the same symmetric signing key. 2. An attacker obtains a valid token issued for another service, environment, or client. 3. The token has an issuer or audience that should not be trusted by the generated API. 4. Th ...[truncated 670 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/templates/exception-middleware.cs.md:58

Finding

Exception Stack Traces Are Returned to Staging Clients

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/templates/csproj-files.md (reported line 27)May include surrounding context.

{{TFM}} ```

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises activation on very common phrases like 'create a new dotnet project' and similar generic development requests. In an agent environment, this can cause the skill to trigger in situations broader than the user intended, leading to unexpected file generation, command execution, or workflow takeover without clear user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'Trigger on any of' section defines broad and overlapping activation conditions without clear exclusions, making accidental invocation likely. Because this skill is designed to write many files and run CLI commands, ambiguous activation increases the risk of unintended destructive or confusing actions in the user's workspace.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

3. If unsure which is the current LTS, fetch the latest .NET support policy via context7 (`mcp__plugin_context7_context7__resolve-library-id` → `query-docs` for ".NET release schedule" / "dotnet support policy") or WebFetch `https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core`. Quote the version you picked back to the user before generating.
4. Pin EF Core, ASP.NET Core, and `Microsoft.Extensions.*` package versions to the **latest stable for that TFM** — look them up via context7 (`Microsoft.EntityFrameworkCore`, `Microsoft.AspNetCore.Authentication.JwtBearer`, etc.) rather than guessing. Never hand-paste a version you don't have a source for.
5. State the chosen TFM and package versions in your reply before writing files, so the user can object before scaffolding.
6. Concrete resolution commands when context7 is unavailable: `dotnet package search <PackageId> --take 1` or WebFetch `https://api.nuget.org/v3-flatcontainer/<package-id-lowercase>/index.json` (last non-preview entry = latest stable). Never write a version string you did not just resolve this session — no versions from memory, no wildcards, no invented numbers.

**API-drift guard.** The version you resolved in this step decides the API shape — training-data memory is the least trustworthy source in this workflow. Highest-risk hallucination zones:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

3. If unsure which is the current LTS, fetch the latest .NET support policy via context7 (`mcp__plugin_context7_context7__resolve-library-id` → `query-docs` for ".NET release schedule" / "dotnet support policy") or WebFetch `https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core`. Quote the version you picked back to the user before generating.
4. Pin EF Core, ASP.NET Core, and `Microsoft.Extensions.*` package versions to the **latest stable for that TFM** — look them up via context7 (`Microsoft.EntityFrameworkCore`, `Microsoft.AspNetCore.Authentication.JwtBearer`, etc.) rather than guessing. Never hand-paste a version you don't have a source for.
5. State the chosen TFM and package versions in your reply before writing files, so the user can object before scaffolding.
6. Concrete resolution commands when context7 is unavailable: `dotnet package search <PackageId> --take 1` or WebFetch `https://api.nuget.org/v3-flatcontainer/<package-id-lowercase>/index.json` (last non-preview entry = latest stable). Never write a version string you did not just resolve this session — no versions from memory, no wildcards, no invented numbers.

**API-drift guard.** The version you resolved in this step decides the API shape — training-data memory is the least trustworthy source in this workflow. Highest-risk hallucination zones:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/templates/worker-program.cs.md (reported line 163)May include surrounding context.

md

## What the worker must **never** do

- `while (true) { ... Task.Delay(5s); }` without checking `stoppingToken` — breaks graceful shutdown.
- Resolve scoped services from the root provider — always create an `IServiceScope` per message.
- Reference `{{Solution}}.Api`. Workers depend on Application + Infrastructure only.
- Catch `Exception` and silently delete the message — that loses the failure forever.

Static analysis

No suspicious patterns detected.