Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Common mistakes AI agents make when generating or modifying .NET code, organized by category. Each category provides a
brief warning, anti-pattern code, corrected code, and a cross-reference to the canonical skill that owns the deep
guidance. This skill does NOT provide full implementation walkthroughs -- it surfaces the mistake and points to the
right skill.
Scope
Common async/await, NuGet, deprecated API, and DI mistakes agents make
Anti-pattern / corrected-code pairs per category
Cross-references to canonical skills for deep guidance
Out of scope
Deep async/await patterns -- see [skill:dotnet-csharp-async-patterns]
Full dependency injection guidance -- see [skill:dotnet-csharp-dependency-injection]
NRT usage patterns -- see [skill:dotnet-csharp-nullable-reference-types]
Source generator authoring -- see [skill:dotnet-csharp-source-generators]
Test framework features -- see [skill:dotnet-testing-strategy]
Security vulnerability mitigation -- see [skill:dotnet-security-owasp]
Prerequisites
.NET 8.0+ SDK. Familiarity with SDK-style projects and C# language features.
Warning: Agents frequently block on async methods using .Result or .Wait(), causing deadlocks in ASP.NET Core
and UI contexts. Another common mistake is fire-and-forget calls that silently swallow exceptions.
Anti-Pattern
// WRONG: blocking on async -- deadlock risk in synchronization contextspublic Order GetOrder(int id)
{
var order = _repository.GetOrderAsync(id).Result; // DEADLOCKreturn order;
}
// WRONG: fire-and-forget with no error handlingpublicvoidProcessOrder(Order order)
{
_ = _emailService.SendConfirmationAsync(order);
}
```text
```csharp
{
order = _repository.GetOrderAsync(id, ct);
order;
}
{
_emailService.SendConfirmationAsync(order, ct);
}
```text
See [skill:dotnet-csharp--patterns] full / guidance including `ValueTask`, `ConfigureAwait`,
cancellation propagation.
---
**Warning:** Agents generate incorrect package names, reference pre-release versions without opt-, packages
that have been deprecated/replaced. ASP.NET Core shared-framework packages must match the project TFM major version.
```xml
<!-- WRONG: = Version= />
<!-- WRONG: hardcoded version shared-framework package -- must match TFM -->
<PackageReference Include= Version= />
<!-- This breaks net8 projects -->
<!-- WRONG: agents Swashbuckle ; .NET + templates use built- OpenAPI -->
<PackageReference Include= Version= />
<!-- Swashbuckle still valid Swagger UI needed, but the choice -->
package name does notexist (correct: Microsoft.EntityFrameworkCore) -->
<PackageReference Include
"EntityFrameworkCore"
"9.0.0"
for
"Microsoft.AspNetCore.Mvc.Testing"
"9.0.0"
on
.0
add
by
default
9
in
"Swashbuckle.AspNetCore"
"7.0.0"
is
when
is
not
default
Corrected
<!-- CORRECT: exact package ID --><PackageReferenceInclude="Microsoft.EntityFrameworkCore"Version="9.0.0" /><!-- CORRECT: use version variable or central package management to match TFM --><PackageReferenceInclude="Microsoft.AspNetCore.Mvc.Testing" /><!-- Version managed via Directory.Packages.props matching project TFM --><!-- CORRECT: .NET 9+ templates prefer built-in OpenAPI support --><PackageReferenceInclude="Microsoft.AspNetCore.OpenApi"Version="9.0.0" /><!-- Swashbuckle remains a valid choice when Swagger UI features are needed -->
See [skill:dotnet-csproj-reading] for project file conventions and central package management guidance.
Category 3: Deprecated API Usage
Warning: Agents generate code using deprecated and insecure APIs: BinaryFormatter (CVE-prone deserialization),
WebClient (replaced by HttpClient), and older cryptography APIs (RNGCryptoServiceProvider,
SHA1CryptoServiceProvider).
Anti-Pattern
// WRONG: BinaryFormatter is banned in .NET 8+ (SYSLIB0011)var formatter = new BinaryFormatter();
formatter.Serialize(stream, data);
// WRONG: WebClient is obsolete -- use HttpClient via IHttpClientFactoryvar client = new WebClient();
var html = client.DownloadString("https://example.com");
// WRONG: obsolete crypto API (SYSLIB0023)usingvar rng = new RNGCryptoServiceProvider();
rng.GetBytes(buffer);
Corrected
// CORRECT: use System.Text.Json for serializationvar json = JsonSerializer.Serialize(data);
await File.WriteAllTextAsync("data.json", json);
// CORRECT: use IHttpClientFactory (registered via DI)publicclassMyService(HttpClient httpClient)
{
publicasync Task<string> GetHtmlAsync(CancellationToken ct = default)
=> await httpClient.GetStringAsync("https://example.com", ct);
}
// CORRECT: modern RandomNumberGenerator (static API)
RandomNumberGenerator.Fill(buffer);
See [skill:dotnet-security-owasp] for the full deprecated security pattern catalog and OWASP mitigations.
Category 4: Project Structure Mistakes
Warning: Agents use wrong SDK types, add PackageReference entries for framework-included libraries, or create
broken ProjectReference paths.
Anti-Pattern
<!-- WRONG: using Microsoft.NET.Sdk for a web project --><ProjectSdk="Microsoft.NET.Sdk"><PropertyGroup><OutputType>Exe</OutputType><TargetFramework>net9.0</TargetFramework></PropertyGroup><!-- Missing WebApplication APIs, Kestrel, etc. --></Project><!-- WRONG: referencing a package already in the shared framework --><PackageReferenceInclude="Microsoft.Extensions.Logging"Version="9.0.0" /><!-- This is included in Microsoft.NET.Sdk.Web; explicit reference causes version conflicts --><!-- WRONG: relative path that doesn't match actual project location --><ProjectReferenceInclude="..\..\Core\MyApp.Core.csproj" /><!-- Actual location is ../MyApp.Core/MyApp.Core.csproj -->
```csharp
### Corrected
```xml
<!-- CORRECT: use the Web SDK for ASP.NET Core projects --><ProjectSdk="Microsoft.NET.Sdk.Web"><PropertyGroup><TargetFramework>net9.0</TargetFramework></PropertyGroup></Project><!-- CORRECT: don't add explicit PackageReference for shared-framework packages --><!-- Microsoft.Extensions.Logging is implicitly available via Sdk.Web --><!-- CORRECT: verify the actual project path before adding a reference --><ProjectReferenceInclude="..\MyApp.Core\MyApp.Core.csproj" />
```csharp
See [skill:dotnet-project-structure] for SDK types, project organization, and project reference conventions.
---
## Category 5: Nullable Reference Type Annotation Errors
**Warning:** Agents misuse the null-forgiving operator (`!`) to silence warnings instead of fixing nullability, or
forget to enable the nullable context.
### Anti-Pattern
```csharp
// WRONG: null-forgiving operator hides a real null risk
public string GetUserName(int id)
{
var user = _db.Users.Find(id);
return user!.Name; // NullReferenceException if user not found
}
// WRONG: nullable not enabled, so annotations are meaningless
// Missing <Nullable>enable</Nullable> in .csproj
public string? GetOptionalValue() => null; // no compiler warnings without nullable context
```csharp
### Corrected
```csharp
// CORRECT: handle null explicitly
public string GetUserName(int id)
{
var user = _db.Users.Find(id);
if (user is null)
{
throw new InvalidOperationException($"User {id} not found.");
}
return user.Name;
}
<!-- CORRECT: enable nullable context in .csproj --><PropertyGroup><Nullable>enable</Nullable></PropertyGroup>
```csharp
See [skill:dotnet-csharp-nullable-reference-types] for full NRT usage patterns and annotation strategies.
---
## Category 6: Source Generator Misconfiguration
**Warning:** Agents forget to mark classes as `partial` when source generators need to augment them, or use incorrect
output types that prevent generator output from compiling.
### Anti-Pattern
```csharp
// WRONG: missing partial keyword -- source generator cannot augment this class
[JsonSerializable(typeof(WeatherForecast))]
internal class WeatherJsonContext : JsonSerializerContext
{
}
// WRONG: generator expects a class but agent declared a struct
[LoggerMessage(EventId = 1, Level = LogLevel.Information, Message = "Processing {Item}")]
public static partial struct LogMessages // struct is invalid for LoggerMessage
{
}
See [skill:dotnet-csharp-source-generators] for source generator configuration, diagnostics, and debugging.
Category 7: Trimming/AOT Warning Suppression
Warning: Agents suppress trimming and AOT warnings with #pragma or [UnconditionalSuppressMessage] instead of
fixing the underlying reflection/dynamic usage. Suppression hides runtime failures in published apps.
Anti-Pattern
// WRONG: suppressing trim warning instead of fixing it#pragmawarning disable IL2026// TODO: Audit suppression - add justification or removevar type = Type.GetType(typeName); // reflection not trim-safevar instance = Activator.CreateInstance(type!);
#pragmawarning restore IL2026// WRONG: app-level suppression in .csproj hides all trim warnings// <NoWarn>IL2026;IL2046;IL3050</NoWarn>
```csharp
### Corrected
```csharp
// CORRECT: use compile-time type resolution or [DynamicallyAccessedMembers]public T CreateInstance<T>() where T : new()
{
returnnew T(); // no reflection, trim-safe
}
// For unavoidable reflection, annotate correctly:publicobjectCreateInstance(
[DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicConstructors)] Type type)
{
return Activator.CreateInstance(type)
?? thrownew InvalidOperationException($"Cannot create {type.Name}");
}
<!-- CORRECT: enable trim/AOT analyzers to catch issues early --><!-- For apps: --><PublishTrimmed>true</PublishTrimmed><EnableTrimAnalyzer>true</EnableTrimAnalyzer><!-- For libraries: --><IsTrimmable>true</IsTrimmable><!-- IsTrimmable auto-enables trim analyzer for libraries -->
See [skill:dotnet-csproj-reading] for MSBuild property guidance on trimming and AOT configuration.
Category 8: Test Organization Anti-Patterns
Warning: Agents put test classes in production projects, use wrong test SDK configurations, or mix test framework
attributes incorrectly.
Anti-Pattern
// WRONG: test class in the production project (not in a separate test project)// File: src/MyApp.Api/OrderServiceTests.csnamespaceMyApp.Api;
publicclassOrderServiceTests
{
[Fact] // xUnit attribute in production code -- ships test dependencies to userspublicvoidCalculateTotal_ReturnsCorrectSum() { }
}
<!-- WRONG: test project missing Microsoft.NET.Test.Sdk and runner --><ProjectSdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>net9.0</TargetFramework></PropertyGroup><ItemGroup><PackageReferenceInclude="xunit.v3"Version="3.2.2" /><!-- Missing Microsoft.NET.Test.Sdk and runner -- dotnet test will find zero tests --></ItemGroup></Project>
Corrected
<!-- CORRECT: test project in tests/ directory with proper configuration --><ProjectSdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>net9.0</TargetFramework><IsTestProject>true</IsTestProject></PropertyGroup><ItemGroup><PackageReferenceInclude="xunit.v3"Version="3.2.2" /><PackageReferenceInclude="xunit.runner.visualstudio"Version="3.1.5" /><PackageReferenceInclude="Microsoft.NET.Test.Sdk"Version="18.0.1" /></ItemGroup><ItemGroup><ProjectReferenceInclude="..\..\src\MyApp.Api\MyApp.Api.csproj" /></ItemGroup></Project>
```csharp
See [skill:dotnet-testing-strategy] for test organization, naming conventions, and test type decision guidance.
---
## Category 9: DI Registration Errors
**Warning:** Agents forget to register services, use wrong lifetimes (singleton capturing scoped), or create captive
dependencies that cause memory leaks and concurrency bugs.
### Anti-Pattern
```csharp
// WRONG: scoped service injected into singleton -- captive dependency
builder.Services.AddSingleton<OrderProcessor>(); // singleton
builder.Services.AddScoped<IOrderRepository, OrderRepository>(); // scoped
public class OrderProcessor(IOrderRepository repo) // repo is captured as singleton!
{
public async Task ProcessAsync(int orderId, CancellationToken ct)
{
var order = await repo.GetByIdAsync(orderId, ct); // same DbContext forever
}
}
// WRONG: missing registration causes runtime exception
// builder.Services.AddScoped<IOrderRepository, OrderRepository>(); // forgot this line
// InvalidOperationException: Unable to resolve service for type 'IOrderRepository'
Corrected (DI)
// CORRECT: lifetimes must not capture shorter-lived dependencies
builder.Services.AddScoped<OrderProcessor>(); // scoped, matches repository lifetime
builder.Services.AddScoped<IOrderRepository, OrderRepository>();
// Or if OrderProcessor must be singleton, inject IServiceScopeFactory:
builder.Services.AddSingleton<OrderProcessor>();
publicclassOrderProcessor(IServiceScopeFactory scopeFactory)
{
publicasync Task ProcessAsync(int orderId, CancellationToken ct)
{
awaitusingvar scope = scopeFactory.CreateAsyncScope();
var repo = scope.ServiceProvider.GetRequiredService<IOrderRepository>();
var order = await repo.GetByIdAsync(orderId, ct);
}
}
```text
See [skill:dotnet-csharp-dependency-injection] for lifetime rules, registration patterns, and service scope management.
---
## Slopwatch Anti-Patterns
These are patterns that indicate an agent is hiding problems rather than fixing them. Every code review should check for
these. See [skill:dotnet-slopwatch] for the automated quality gate that detects these patterns.
### 1. Disabled or Skipped Tests
```csharp
// RED FLAG: skipping tests to make the build pass
[Fact(Skip = "Flaky, will fix later")] // test never gets fixedpublicvoidCriticalBusinessLogic_WorksCorrectly() { }
// RED FLAG: commenting out failing tests// [Fact]// public void CalculateTotal_HandlesNegative() { ... }// RED FLAG: conditional compilation to hide tests#if false
[Fact]
publicvoidImportantEdgeCase() { }
#endif
Fix: Investigate and fix the underlying issue. If a test is genuinely flaky due to timing, use [Retry] (xUnit v3)
or fix the non-determinism. Never disable tests to achieve a green build.
2. Warning Suppressions
// RED FLAG: blanket warning suppression#pragmawarning disable CS8600, CS8602, CS8604 // suppress all nullability warningsvar result = GetData();
result.Process();
#pragmawarning restore CS8600, CS8602, CS8604// RED FLAG: project-level suppression hiding real issues// <NoWarn>CS8618;CS8625;IL2026</NoWarn>
Fix: Address the underlying nullability or trim issues. Add proper null checks, use nullable annotations correctly,
or apply [DynamicallyAccessedMembers] for trim warnings.
3. Empty Catch Blocks
// RED FLAG: swallowing exceptions silentlytry
{
await _service.ProcessAsync(data, ct);
}
catch (Exception) { } // failure is invisible// RED FLAG: catch-and-ignore with misleading commentcatch (Exception ex)
{
// TODO: add logging
}
Fix: At minimum, log the exception. Prefer catching specific exception types and handling them appropriately.
4. Silenced Analyzers Without Justification
// RED FLAG: suppressing analyzer with no explanation
[SuppressMessage("Design", "CA1062")]
publicvoidProcess(string input) { }
// RED FLAG: disabling analyzer rules in .editorconfig globally// dotnet_diagnostic.CA1062.severity = none
Fix: Fix the code to satisfy the analyzer rule, or provide a documented justification in the suppression attribute:
[SuppressMessage("Design", "CA1062", Justification = "Input validated by middleware")].
5. Removed Assertions from Tests
// RED FLAG: test with no assertions -- always passes
[Fact]
publicasync Task CreateOrder_Succeeds()
{
var service = new OrderService();
await service.CreateOrderAsync(new Order());
// no Assert -- this test proves nothing
}
Fix: Every test must have at least one assertion that validates the expected behavior. If the test is for side
effects, assert on the side effect (database state, published events, log output).
Cross-References
[skill:dotnet-csharp-async-patterns] -- async/await deep patterns, ValueTask, cancellation
[skill:dotnet-csharp-dependency-injection] -- DI lifetime rules, registration patterns, scope management
