csharp-developer
Analysis
This is mostly a normal instruction-only C# development skill, but it includes a hard-coded delivery message that could make unverified performance and security claims.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Review .csproj files, NuGet packages, and solution architecture ... Implement solutions leveraging modern C# features and .NET best practices
The skill directs the agent to inspect project files and implement changes. That is expected for a developer skill, but users should ensure edits are limited to the intended repository and task.
Source: unknown; Homepage: none
The skill has limited provenance metadata. This is lower risk because it is instruction-only and has no install spec or code files, but users cannot easily trace the source.
Quality checklist: ... Tests passing ... Performance verified ... Security scan clean ... NuGet audit passed
The workflow implies test, profiling, scan, or audit activity. Those activities are normal for .NET development, but they can execute or analyze project code if the host provides such tools.
Delivery message: ".NET implementation completed. Delivered ASP.NET Core 8 API with Blazor WASM frontend, achieving 20ms p95 response time... comprehensive tests (86% coverage), and AOT-ready configuration reducing memory by 40%."
The skill provides a polished completion message with specific performance, coverage, security, and memory claims. If repeated without measured evidence, it could cause users to overtrust the result.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Query context manager for existing .NET solution structure and project configuration
The skill relies on retrieved context about the project. Such context can be stale or incorrect, so it should be checked against actual project files.