How do I install the Code Review Dotnet skill?

Run npx skillmds@latest add noorqureshi/code-review-dotnet in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Review Dotnet safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Review Dotnet?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Review Dotnet free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Code Review Dotnet?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Review Dotnet by noorqureshi — Agent Skill

Name: Code Review Dotnet
Author: NoorQureshi

Code Review Dotnet

Security review of .NET / C# code — dangerous sinks and ASP.NET pitfalls. Load when reviewing a C#/.NET codebase/PR, on .cs source in scope, or "review this .NET app". Signals: .csproj/.sln, ASP.NET (Core/MVC/WebForms), BinaryFormatter, SqlCommand, Razor Html.Raw, XmlDocument.

NoorQureshi 6ca5356 2.8 KB Updated Sep 17, 2026

File contents

.NET / C# source review

When it applies

Reviewing C#/.NET source (ASP.NET Core, MVC, or legacy WebForms). The headline risks are unsafe deserialization, string-built SQL, XXE, and Razor's raw-output escape hatch.

Why it works

.NET ships powerful-but-dangerous serializers (BinaryFormatter, Json.NET with TypeNameHandling, LosFormatter/ViewState) that instantiate arbitrary types, and several XML APIs resolve DTDs by default on older frameworks. Reviews find where these meet untrusted input.

Sinks & patterns (grep, then trace to user input)

Deserialization: BinaryFormatter, LosFormatter, SoapFormatter, NetDataContractSerializer, JsonConvert with TypeNameHandling != None, Js.NET/fastJSON polymorphic types → RCE gadgets.
SQLi: string-concatenated SqlCommand/ExecuteReader/FromSqlRaw(EF Core) vs parameters.
Command exec: Process.Start with concatenated arguments / UseShellExecute.
XXE: XmlDocument/XmlReader/XmlTextReader without DtdProcessing=Prohibit (legacy default resolves entities); XmlSerializer with a user-controlled type.
XSS: Razor @Html.Raw(...), MvcHtmlString, WebForms <%= %> with unencoded input; Response.Write.
Other: path traversal via Path.Combine(root, input), LdapConnection filter injection, reflection (Type.GetType/Activator.CreateInstance) on input, insecure ViewState (no MAC).

Framework specifics

ASP.NET Core: model binding over-posting/mass assignment (bind whole entity), [AllowAnonymous] on sensitive actions, disabled antiforgery on POST APIs, exposed dev endpoints, open redirect via Redirect(returnUrl) without Url.IsLocalUrl.
WebForms: ViewState deserialization (machineKey), event-validation off.

Method

Run security-code-scan/CodeQL; treat as leads.
rg 'BinaryFormatter|TypeNameHandling|FromSqlRaw|Html\.Raw|XmlDocument|Process\.Start' → trace to input.
Check controller [Authorize]/antiforgery coverage and model-binding scope.
Confirm with web-deserialization, web-sqli, web-xxe, web-command-injection.

Gotchas

Json.NET is safe by default — the bug is an explicit TypeNameHandling.All/Auto.
EF Core parameterises LINQ; FromSqlRaw/ExecuteSqlRaw with interpolation is where SQLi returns.
ViewState RCE needs the machineKey (leaked/weak) — note the precondition.

References

OWASP .NET security cheat sheet; ysoserial.net gadget research; Microsoft secure-coding guidance.

---name: code-review-dotnetdescription: Security review of .NET / C# code — dangerous sinks and ASP.NET pitfalls. Load when reviewing a C#/.NET codebase/PR, on .cs source in scope, or "review this .NET app". Signals: .csproj/.sln, ASP.NET (Core/MVC/WebForms), BinaryFormatter, SqlCommand, Razor Html.Raw, XmlDocument.---# .NET / C# source review## When it appliesReviewing C#/.NET source (ASP.NET Core, MVC, or legacy WebForms). The headline risks are unsafedeserialization, string-built SQL, XXE, and Razor's raw-output escape hatch.## Why it works.NET ships powerful-but-dangerous serializers (`BinaryFormatter`, `Json.NET` with`TypeNameHandling`, `LosFormatter`/ViewState) that instantiate arbitrary types, and several XML APIsresolve DTDs by default on older frameworks. Reviews find where these meet untrusted input.## Sinks & patterns (grep, then trace to user input)- **Deserialization**: `BinaryFormatter`, `LosFormatter`, `SoapFormatter`, `NetDataContractSerializer`, `JsonConvert` with `TypeNameHandling != None`, `Js.NET`/`fastJSON` polymorphic types → RCE gadgets.- **SQLi**: string-concatenated `SqlCommand`/`ExecuteReader`/`FromSqlRaw`(EF Core) vs parameters.- **Command exec**: `Process.Start` with concatenated arguments / `UseShellExecute`.- **XXE**: `XmlDocument`/`XmlReader`/`XmlTextReader` without `DtdProcessing=Prohibit` (legacy default resolves entities); `XmlSerializer` with a user-controlled type.- **XSS**: Razor `@Html.Raw(...)`, `MvcHtmlString`, WebForms `<%= %>` with unencoded input; `Response.Write`.- **Other**: path traversal via `Path.Combine(root, input)`, `LdapConnection` filter injection, reflection (`Type.GetType`/`Activator.CreateInstance`) on input, insecure ViewState (no MAC).## Framework specifics- **ASP.NET Core**: model binding over-posting/mass assignment (bind whole entity), `[AllowAnonymous]` on sensitive actions, disabled antiforgery on POST APIs, exposed dev endpoints, open redirect via `Redirect(returnUrl)` without `Url.IsLocalUrl`.- **WebForms**: ViewState deserialization (machineKey), event-validation off.## Method1. Run `security-code-scan`/CodeQL; treat as leads.2. `rg 'BinaryFormatter|TypeNameHandling|FromSqlRaw|Html\.Raw|XmlDocument|Process\.Start'` → trace to input.3. Check controller `[Authorize]`/antiforgery coverage and model-binding scope.4. Confirm with `web-deserialization`, `web-sqli`, `web-xxe`, `web-command-injection`.## Gotchas- `Json.NET` is safe by default — the bug is an explicit `TypeNameHandling.All/Auto`.- EF Core parameterises LINQ; `FromSqlRaw`/`ExecuteSqlRaw` with interpolation is where SQLi returns.- ViewState RCE needs the `machineKey` (leaked/weak) — note the precondition.## ReferencesOWASP .NET security cheat sheet; ysoserial.net gadget research; Microsoft secure-coding guidance.

Frequently asked questions