A reusable Claude Code skill for reviewing ASP.NET Core endpoint changes
Nick Cosentino explains how to package a recurring .NET review job as a project-scoped Claude Code skill. The example reviews endpoint changes across validation, authorization, response mapping and persistence, and the article stresses clear limits on what the agent may run. It is a practical starting point for teams that want repeatable AI-assisted reviews of ASP.NET Core code.
Key points
- The skill file lives at .claude/skills/<skill-name>/SKILL.md in the repository for project scope.
- disable-model-invocation: true stops Claude from loading the skill automatically; the developer calls it with /review-dotnet-endpoint.
- The report should contain scope, findings, verification and gaps, with unrun checks kept separate.
- Builds, tests, migrations and deployments stay off-limits unless separately authorized for the task.
- Every finding needs a file reference and supporting evidence; a test name or passing summary is not proof.
- If a new top-level skills directory does not appear, the docs suggest /reload-skills; use /skills to diagnose discovery.
Nick Cosentino shows how to turn a recurring .NET review task into a project-scoped Claude Code skill stored at .claude/skills/review-dotnet-endpoint/SKILL.md. The sample skill traces a changed endpoint's validation, authorization, response mapping and persistence through the code that actually collaborates with it. Setting disable-model-invocation means the agent will not load it on its own; the developer invokes it explicitly.
The skill's output follows a fixed shape: scope, findings, verification and gaps, with unrun checks kept separate from results. It also forbids builds, tests, migrations and writes unless someone authorizes them for the task. The author recommends testing the skill against cases with a real defect, adequate coverage and blocked verification, and warns that the examples have not been exercised. Repository facts belong in manifests, and permissions belong in client configuration.
Real-world use
- An ASP.NET Core team wants consistent pre-pull-request reviews of minimal API endpoint changes.
- A service whose validation or authorization rules change needs a check for missing validation tests.
- A reviewer works where tests cannot run and needs proposed checks kept separate from executed results.
Why it matters
Teams that move recurring review steps into a project-scoped skill get more consistent, auditable reports. The skill still needs explicit limits on what it may run and what evidence it must cite.