Vigilante .NET Issue Implementation: A Security-First Agent Skill

Where this fits

You're a developer maintaining a .NET/C# repo with strict analyzer rules and security policies. When Vigilante—your issue triage bot—dispatches a bug report or feature request, you'd normally spend minutes parsing the repo's conventions, running dotnet format, checking nullable warnings, and making sure you don't break the build. This skill automates that entire loop: it reads the dispatch prompt, detects the tech stack and security guidance, then implements the issue end-to-end while respecting your existing workflow. Instead of babysitting an agent through each step, you get a focused, compliant pull request.

Why agents benefit

• Context-aware scoping: The skill reads the prompt for process hints and .NET security guidance before touching code, so it won't wander into unrelated refactors or dependency upgrades.
• Toolchain discipline: It runs dotnet format on the affected project/solution, executes targeted dotnet test first, and broadens only when the change crosses boundaries—matching how a senior dev would work.
• Analyzer compliance: It respects .editorconfig, Directory.Build.props, and built-in analyzers, never weakening warning severities without a narrow, justified exception.
• Security-first changes: The skill internalizes .NET-specific security patterns (e.g., avoiding unsafe deserialization, validating inputs) and applies them to the issue at hand.
• Reproducible workflow: Agents get a deterministic sequence—read guidance, modify code, format, test, commit—reducing the chance of incomplete or sloppy PRs.

Practical scenarios

Fixing a vulnerability in an ASP.NET Core endpoint

The issue reports a path traversal in a file download controller. The skill identifies the security guidance in the prompt, locates the relevant handler, and applies Path.GetFullPath validation with proper allow-list checks—all while keeping the change scoped to that endpoint and running the controller's unit tests.

Implementing a new analyzer rule across a solution

Your repo just adopted a new nullable analysis rule. The skill reads the .editorconfig and Directory.Build.props, updates the affected project files, and runs dotnet build with warnings-as-errors to catch every violation. It then adjusts only the code that needs changes, leaving unrelated files untouched.

Adding a feature with test coverage in a legacy codebase

A dispatch asks for a new logging feature in a .NET Framework project. The skill detects the older project structure, avoids modern SDK commands that don't apply, writes tests using the existing test framework, and runs the targeted test project first—ensuring compatibility without breaking the build.

Add it to your agent workflow

Install the skill into your agent's toolkit with:

npx skills add aliengiraffe/vigilante --skill vigilante-issue-implementation-on-dotnet

Then, when Vigilante dispatches a .NET issue, your agent can invoke the skill by name. A typical usage prompt might be:

Use the vigilante-issue-implementation-on-dotnet skill to implement issue #142. Follow the repository's existing formatting and test workflow. Do not modify unrelated files.

The skill will handle the rest, from reading the prompt's security hints to committing a clean, tested change. For a deeper look at how this skill fits into a broader agent skill ecosystem, check out OpenAgentSkill for related patterns.

Compare before adopting

Before adding this skill to your stack, compare it against your current agent's default behavior. Look at quality signals: does it consistently pass CI on first try? Check maintenance freshness—is the skill updated for the latest .NET SDK versions? Evaluate alternatives like generic issue-implementation skills that lack .NET-specific guardrails. Also assess workflow fit: does your repo use dotnet format or a custom formatter? Does it enforce specific test runners? The skill should align with your existing conventions or be easily adaptable.

Why it is worth tracking

With 37 stars and an active author, this skill shows early community traction for security-focused .NET agent work. It's worth tracking because it represents a shift from generic code generation to domain-aware implementation—something that will only become more critical as agents handle production code. Evaluate it when your team adopts Vigilante or when you need an agent that respects .NET analyzer and security rules without constant supervision.