[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-dotnet-binskim-scan":3,"mdc-4urmkr-key":36,"related-org-dotnet-binskim-scan":2194,"related-repo-dotnet-binskim-scan":2361},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"binskim-scan","run BinSkim binary security analysis","Run BinSkim binary security analysis locally against a dotnet repository. Use when asked to scan binaries, check BinSkim compliance, verify a fix for a rule violation, or run a local SDL scan. Also use when asked \"run binskim\", \"binary security scan\", \"scan binaries\", \"check binskim\", \"verify my fix\", \"repro BA2008 locally\", or \"verify BA2008 fix\". DO NOT USE FOR: investigating official pipeline results or portal findings (use binskim-analysis), source code analysis (use CodeQL), credential scanning (use CredScan), or general build\u002Ftest failures (use ci-analysis).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"dotnet",".NET (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fdotnet.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},".NET","net",{"name":20,"slug":21,"type":15},"CLI","cli",{"name":23,"slug":24,"type":15},"Code Analysis","code-analysis",12,"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Farcade-skills","2026-07-12T08:23:09.911458",null,18,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Reuseable AI skills, plugins, agents for use in the dotnet product repos, such as dotnet\u002Fruntime","https:\u002F\u002Fgithub.com\u002Fdotnet\u002Farcade-skills\u002Ftree\u002FHEAD\u002Fplugins\u002Fdotnet-compliance\u002Fskills\u002Fbinskim-scan","---\nname: binskim-scan\ndescription: >\n  Run BinSkim binary security analysis locally against a dotnet repository.\n  Use when asked to scan binaries, check BinSkim compliance, verify a fix for a rule violation,\n  or run a local SDL scan. Also use when asked \"run binskim\", \"binary security scan\", \"scan binaries\",\n  \"check binskim\", \"verify my fix\", \"repro BA2008 locally\", or \"verify BA2008 fix\". DO NOT USE FOR:\n  investigating official pipeline results or portal findings (use binskim-analysis), source code\n  analysis (use CodeQL), credential scanning (use CredScan), or general build\u002Ftest failures\n  (use ci-analysis).\n---\n\n# BinSkim Local Scanning\n\nRun BinSkim locally against a dotnet repository to find binary security issues. This skill covers installing BinSkim, building the repo, discovering what the official pipeline scans, running BinSkim with matching targeting, and interpreting results.\n\n> **Local scans are an approximation.** The official pipeline runs BinSkim via Guardian with additional filtering. Local scans produce a **superset** of official findings. For understanding what the portal reports vs what BinSkim finds, use the **binskim-analysis** skill. For authoritative pass\u002Ffail confirmation, recommend the user manually queue the official CI pipeline against their branch — SDL does not run on PR validation builds.\n\n## When to Use This Skill\n\n- Running BinSkim locally to scan binaries for security issues\n- Verifying a fix for a BinSkim rule violation before pushing\n- Checking whether a repo's scan config covers everything it ships\n- Iterating on a fix with fast local feedback\n\n**Not for**: interpreting official pipeline results (use **binskim-analysis**), source code security (CodeQL), or credential scanning (CredScan).\n\n## Prerequisites\n\n- **BinSkim**: See [references\u002Fbinskim-install.md](references\u002Fbinskim-install.md) for installation.\n  - Windows: `~\\.binskim\\extracted\\tools\\net9.0\\win-x64\\BinSkim.exe`\n  - Linux: `~\u002F.binskim\u002Fextracted\u002Ftools\u002Fnet9.0\u002Flinux-x64\u002FBinSkim`\n- **Build toolchain**: .NET SDK (managed builds). For native code: MSVC + CMake on Windows, gcc\u002Fclang + CMake on Linux. See [references\u002Fbuild-prereqs.md](references\u002Fbuild-prereqs.md).\n- **Repo cloned locally**: Typically under `C:\\git\\\u003Crepo-name>` (Windows) or `~\u002Fgit\u002F\u003Crepo-name>` (Linux).\n\n## Local Scan Workflow\n\n### Step 1: Discover Pipeline BinSkim Configuration\n\nBefore scanning, read the repo's pipeline YAML to understand what the official scan targets.\n\n1. **Find the pipeline YAML** — look for `azure-pipelines-official.yml`, `vsts-ci.yml`, `.vsts-ci.yml`, `azure-pipelines.yml`, or `.ado.yml` at the repo root or under `eng\u002Fpipelines\u002F`. SDL is typically only in the CI\u002Fofficial pipeline, not the PR one.\n2. **Find the `sdl.binskim` section**:\n   ```yaml\n   sdl:\n     binskim:\n       enabled: true\n       scanOutputDirectoryOnly: true\n   ```\n3. **Check for `sdl.binskim.additionalRunConfigParams`** — custom flags\u002Fexclusions.\n4. **Identify what artifacts are published** — look for `PublishPipelineArtifact` steps. The scan targets these.\n\n> **Report what you find.** Tell the user: \"The official pipeline scans X with config Y. I'll reproduce that locally.\"\n\n> **No SDL config?** Some repos have no `sdl.binskim` section at all. In that case, identify what the pipeline publishes as artifacts (e.g., `**\\bin\\Release\\**`) and scan that. Note to the user: \"This repo has no explicit BinSkim\u002FSDL configuration. Scanning the published artifact directory as a best-effort approximation. Results may differ from any central SDL portal findings.\"\n\n### Step 2: Build the Repo\n\n**BinSkim scans built\u002Fpackaged binaries, not source code.** You must build (and often pack) the repo.\n\n```powershell\n# Windows\nbuild.cmd -c Release -pack\n\n# Linux\n.\u002Fbuild.sh -c Release -pack\n```\n\n**What to build depends on pipeline config:**\n\n| Pipeline config | Build command | Scan target |\n|---|---|---|\n| `scanOutputDirectoryOnly` + publishes `pkgassets` | `build.cmd -c Release -pack` | `artifacts\\pkgassets\\**` |\n| `scanOutputDirectoryOnly` + publishes NuGet packages | `build.cmd -pack` then extract .nupkg | Extracted .nupkg contents |\n| Explicit `analyzeTargetGlob` | `build.cmd -c Release` | Use the glob from YAML |\n| Autobaselining only | `build.cmd -c Release` | `artifacts\\bin\\**` (best guess) |\n\n**Extracting .nupkg for scanning** (mirrors `eng\u002Fcommon\u002Fsdl\u002Fextract-artifact-packages.ps1`):\n\n```powershell\n$nupkgDir = [System.IO.Path]::Combine(\"artifacts\", \"packages\", \"Release\", \"Shipping\")\n$extractDir = Join-Path \"artifacts\" \"extracted-for-scan\"\nAdd-Type -AssemblyName System.IO.Compression.FileSystem\nGet-ChildItem (Join-Path $nupkgDir \"*.nupkg\") | ForEach-Object {\n    $dest = Join-Path $extractDir $_.BaseName\n    New-Item -ItemType Directory -Path $dest -Force | Out-Null\n    $zip = [System.IO.Compression.ZipFile]::OpenRead($_.FullName)\n    $zip.Entries | Where-Object { $_.Name -match '\\.(dll|exe|pdb)$' } | ForEach-Object {\n        $target = Join-Path $dest $_.FullName\n        New-Item -ItemType Directory -Path (Split-Path $target) -Force | Out-Null\n        [System.IO.Compression.ZipFileExtensions]::ExtractToFile($_, $target, $true)\n    }\n    $zip.Dispose()\n}\n```\n\n> Only extract **Shipping** packages unless you have reason to scan NonShipping too.\n\n> **Native builds may require extra setup.** If native code fails to build, you can still scan pre-built native DLLs from the NuGet cache. Many rules (including BA2008) don't need PDBs. See [references\u002Fbuild-prereqs.md](references\u002Fbuild-prereqs.md).\n>\n> **NuGet cache limitation**: This only covers third-party native blobs consumed via NuGet. It misses first-party native code compiled from source, managed assemblies the repo builds, and pack-only artifacts. For repos where all findings are on NuGet-sourced binaries (e.g., machinelearning's Intel DLLs), this is sufficient. For repos that compile native code from source, a full build is needed.\n\n### Step 3: Run BinSkim\n\n**Preferred: Use the helper script** (from the skill's `scripts\u002F` directory, or provide its full path):\n\n```powershell\n$script = [System.IO.Path]::Combine(\"plugins\", \"dotnet-dnceng\", \"skills\", \"binskim-scan\", \"scripts\", \"Invoke-BinSkimScan.ps1\")\n\n# Scan a directory:\n& $script -RepoRoot C:\\git\\machinelearning -ScanDir (Join-Path \"artifacts\" \"pkgassets\")\n\n# Filter to portal-reported rules only:\n& $script -RepoRoot C:\\git\\machinelearning -ScanDir (Join-Path \"artifacts\" \"pkgassets\") -PortalRulesFrom C:\\temp\\Results.sarif\n\n# Auto-discover scan targets:\n& $script -RepoRoot C:\\git\\machinelearning\n```\n\n**Manual invocation:**\n\n```powershell\n# Adjust path to your platform – see binskim-install.md for installation\n$binskim = [System.IO.Path]::Combine($HOME, \".binskim\", \"tools\", \"net9.0\", \"linux-x64\", \"BinSkim\")   # Linux\n# $binskim = [System.IO.Path]::Combine($HOME, \".binskim\", \"tools\", \"net9.0\", \"win-x64\", \"BinSkim.exe\") # Windows\n$targetGlob = Join-Path \"artifacts\" \"pkgassets\" \"**\"\n& $binskim analyze $targetGlob --recurse --output binskim-results.sarif --log PrettyPrint --force --Hashes False\n```\n\n> **Don't filter to `*.dll` only** — scan `**` and let BinSkim decide what's analyzable. This catches `.exe`, `.sys`, `.so`, `.dylib`, and extensionless Mach-O executables. BinSkim identifies binary format by magic bytes, not file extension.\n\n### Step 4: Analyze Results\n\n```powershell\n$sarif = Get-Content -Raw binskim-results.sarif | ConvertFrom-Json\n# IMPORTANT: Results.sarif may have multiple runs (BinSkim, roslynanalyzers, etc.)\n# Filter to the BinSkim run by tool name — don't assume runs[0]\n$binskimRun = $sarif.runs | Where-Object { $_.tool.driver.name -like '*BinSkim*' } | Select-Object -First 1\nif (-not $binskimRun) { $binskimRun = $sarif.runs[0] }  # fallback\n$results = $binskimRun.results\n$errors = $results | Where-Object { $_.level -eq 'error' }\n$warnings = $results | Where-Object { $_.level -eq 'warning' }\nWrite-Host \"Errors: $($errors.Count), Warnings: $($warnings.Count)\"\n$errors | Group-Object ruleId | Sort-Object Count -Descending | Format-Table Count, Name\n```\n\n**Present results as:**\n1. Summary table: rule ID, count, severity\n2. Per-binary breakdown for errors\n3. For each finding: first-party (built in repo) or third-party (from NuGet)?\n\n### Step 5: Compare with Official Results (if applicable)\n\nIf the user provides official results, map findings and flag:\n- **Gaps**: findings in official but not local (packaging differences)\n- **Extras**: findings local but not official (scanning too broadly, or Guardian filtering)\n\nLocal scans are a **superset** — more findings than the portal is expected. Use `-PortalRulesFrom` to filter local results to match portal rules.\n\n## Cross-Platform\n\nBinSkim ships for Windows, Linux (x64, arm64), and macOS (x64):\n- Windows: `tools\u002Fnet9.0\u002Fwin-x64\u002FBinSkim.exe`\n- Linux: `tools\u002Fnet9.0\u002Flinux-x64\u002FBinSkim` (`chmod +x`)\n- macOS: `tools\u002Fnet9.0\u002Fosx-x64\u002FBinSkim` (x64 only — no arm64 runtime in package; use Rosetta on Apple Silicon)\n\n**Each OS build produces different native binaries with potentially different BinSkim findings.** If the repo ships native binaries for multiple platforms, you need to scan binaries from each target OS — not just Windows.\n\nUse `build.sh` on Linux\u002FmacOS to build for those platforms. If the official pipeline only runs BinSkim on Windows legs, flag this as a coverage gap — the pipeline should scan all OS configurations that produce shipped native artifacts.\n\n### Cross-platform scanning — any binary on any OS\n\n**BinSkim can scan PE, ELF, and Mach-O binaries on any OS.** BinSkim identifies binary format by magic bytes (not file extension or host OS). The Windows build can analyze Linux `.so` files and macOS `.dylib` files, and vice versa. All the binary parsing is pure managed code with no platform-specific dependencies.\n\nThis means you can:\n- Scan macOS `.dylib` files on a Windows dev machine\n- Scan Linux `.so` files on a Windows dev machine\n- Download official build artifacts from any platform and scan them locally, regardless of your OS\n\n**The key requirement is passing the right file patterns.** BinSkim discovers files via glob patterns you supply (e.g., `*.dll`). If you only pass `*.dll`, it won't find `.dylib` or `.so` files — not because it can't analyze them, but because the glob doesn't match. Use `**` (all files) or explicit patterns like `*.dylib *.so` to scan non-PE binaries.\n\n> **Why do official pipelines miss non-Windows binaries?** The 1ES\u002FGuardian SDL template invokes BinSkim with Windows-centric glob patterns (matching `.dll`, `.exe`, `.sys`). Mach-O and ELF binaries are never enumerated — they aren't \"rejected\", they're simply never passed to BinSkim. This is a configuration gap in how the pipeline invokes BinSkim, not a BinSkim limitation.\n\n### Scanning downloaded official artifacts\n\nThere are two main scenarios for local BinSkim scanning:\n\n- **Verifying a local fix**: Build the repo (or sub-repo) locally and scan the output. This is the normal workflow.\n- **Analyzing platforms not covered by official SDL**: If official runs don't scan certain platforms (e.g., Linux\u002FmacOS binaries), you can download official build artifacts and scan them locally on any OS — BinSkim can analyze PE, ELF, and Mach-O binaries on any platform. This is also useful for initial triage before fixing anything.\n\nFor the artifact download approach, official BinSkim and Guardian SARIF files from the SDL artifacts give you the same information without re-scanning. Re-scanning downloaded artifacts is only needed when official SDL doesn't cover a platform. BinSkim can analyze binaries from any platform on any OS, so you don't need a macOS machine to scan `.dylib` files.\n\nTo scan downloaded artifacts:\n\n1. **Download build artifacts** from AzDO (use `ado-dnceng-pipelines_download_artifact` or REST API)\n2. **Extract native binaries** — artifacts often contain `.tar.gz` inside `.nupkg` or zip files\n   - For `.tar.gz` extraction: use `tar.exe` (built into Windows 10+) or 7-Zip\n   - PowerShell 7.4+ on .NET 8+ also supports tar via `[System.Formats.Tar.TarFile]::ExtractToDirectory()`\n3. **Identify native binaries** by file header magic bytes (ELF: `\\x7fELF`, Mach-O: `\\xfe\\xed\\xfa\\xce`\u002F`\\xcf\\xfa\\xed\\xfe`)\n4. **Scan with BinSkim** using the appropriate platform binary\n\n## Before\u002FAfter Comparison\n\nTo prove a fix works, scan before and after:\n\n```powershell\n# Baseline on main, then fix branch\n$before = (Get-Content -Raw binskim-before.sarif | ConvertFrom-Json).runs[0].results | Where-Object { $_.level -eq 'error' }\n$after  = (Get-Content -Raw binskim-after.sarif  | ConvertFrom-Json).runs[0].results | Where-Object { $_.level -eq 'error' }\nWrite-Host \"Before: $($before.Count) errors, After: $($after.Count) errors\"\n```\n\n> This requires two full builds. Only use when the user needs proof a fix works.\n\n## Fix Strategies\n\n### Classify the finding first\n\n1. Search the repo for the binary name — is there a project that produces it?\n2. Check NuGet packages — is it from a `PackageReference`?\n3. Check for `\u003CContent Include=\"...\">` — is it a pre-built file being copied?\n\n### Fix by origin\n\n| Binary origin | Example | Fix approach |\n|---|---|---|\n| **C++ source** (`.vcxproj`) | EtwClrProfiler.dll | Add compiler\u002Flinker flags (e.g., `\u002Fguard:cf`) |\n| **Pre-built native from NuGet** | Intel MKL\u002FTBB, WiX winterop.dll | Cannot fix here — update package, file upstream, or suppress |\n| **Test framework** | xunit.*.dll | Fix scan scope — exclude from shipped artifacts |\n| **Managed C# assembly** | Most `.dll` from `.csproj` | BA2008 not applicable (BinSkim skips IL-only) |\n\n> `\u003CControlFlowGuard>Guard\u003C\u002FControlFlowGuard>` in a `.csproj` does **nothing**. This MSBuild property only works in `.vcxproj` (MSVC C++).\n\n### VMR fix ownership\n\nIn the VMR (dotnet\u002Fdotnet), look at the SARIF artifact path to find the source sub-repo (e.g., `src\u002Farcade\u002Fartifacts\u002F...` means the fix goes to `dotnet\u002Farcade`).\n\n## Anti-Patterns\n\n> Don't scan `artifacts\\bin\\` if the pipeline uses `scanOutputDirectoryOnly` — you'll get findings from test dependencies that aren't shipped.\n\n> Don't skip the pack step — many shippable binaries only materialize during packing.\n\n> Don't assume the native build is required — scan NuGet-cached DLLs if native build fails locally.\n\n> Don't report NuGet transitive dependency findings as repo issues — if `libSkiaSharp.dll` fails BA2008, that's SkiaSharp's issue.\n\n> Don't be alarmed by extra local findings — use `-PortalRulesFrom` to filter to portal-reported rules. For rules reference and Guardian filtering details, see the **binskim-analysis** skill.\n\n## References\n\n- **Installing BinSkim**: [references\u002Fbinskim-install.md](references\u002Fbinskim-install.md)\n- **Build prerequisites**: [references\u002Fbuild-prereqs.md](references\u002Fbuild-prereqs.md)\n- **Per-repo pipeline configs**: Use the `binskim-analysis` skill for known pipeline names, SDL artifact patterns, and local repro notes per repo\n- **Arcade SDL infrastructure**: Use the `binskim-analysis` skill for `configure-sdl-tool.ps1` and `extract-artifact-packages.ps1` details\n- **Rules reference and Guardian filtering**: See the **binskim-analysis** skill\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,50,56,85,92,117,133,139,229,235,242,247,436,449,477,483,493,544,552,707,725,852,867,895,901,919,1003,1011,1058,1116,1122,1209,1217,1235,1241,1246,1269,1288,1294,1299,1345,1355,1368,1374,1398,1403,1434,1487,1520,1526,1531,1554,1566,1571,1695,1701,1706,1745,1753,1759,1765,1798,1804,1943,1978,1984,2005,2011,2034,2042,2050,2066,2087,2093,2188],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"binskim-local-scanning",[47],{"type":48,"value":49},"text","BinSkim Local Scanning",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54],{"type":48,"value":55},"Run BinSkim locally against a dotnet repository to find binary security issues. This skill covers installing BinSkim, building the repo, discovering what the official pipeline scans, running BinSkim with matching targeting, and interpreting results.",{"type":42,"tag":57,"props":58,"children":59},"blockquote",{},[60],{"type":42,"tag":51,"props":61,"children":62},{},[63,69,71,76,78,83],{"type":42,"tag":64,"props":65,"children":66},"strong",{},[67],{"type":48,"value":68},"Local scans are an approximation.",{"type":48,"value":70}," The official pipeline runs BinSkim via Guardian with additional filtering. Local scans produce a ",{"type":42,"tag":64,"props":72,"children":73},{},[74],{"type":48,"value":75},"superset",{"type":48,"value":77}," of official findings. For understanding what the portal reports vs what BinSkim finds, use the ",{"type":42,"tag":64,"props":79,"children":80},{},[81],{"type":48,"value":82},"binskim-analysis",{"type":48,"value":84}," skill. For authoritative pass\u002Ffail confirmation, recommend the user manually queue the official CI pipeline against their branch — SDL does not run on PR validation builds.",{"type":42,"tag":86,"props":87,"children":89},"h2",{"id":88},"when-to-use-this-skill",[90],{"type":48,"value":91},"When to Use This Skill",{"type":42,"tag":93,"props":94,"children":95},"ul",{},[96,102,107,112],{"type":42,"tag":97,"props":98,"children":99},"li",{},[100],{"type":48,"value":101},"Running BinSkim locally to scan binaries for security issues",{"type":42,"tag":97,"props":103,"children":104},{},[105],{"type":48,"value":106},"Verifying a fix for a BinSkim rule violation before pushing",{"type":42,"tag":97,"props":108,"children":109},{},[110],{"type":48,"value":111},"Checking whether a repo's scan config covers everything it ships",{"type":42,"tag":97,"props":113,"children":114},{},[115],{"type":48,"value":116},"Iterating on a fix with fast local feedback",{"type":42,"tag":51,"props":118,"children":119},{},[120,125,127,131],{"type":42,"tag":64,"props":121,"children":122},{},[123],{"type":48,"value":124},"Not for",{"type":48,"value":126},": interpreting official pipeline results (use ",{"type":42,"tag":64,"props":128,"children":129},{},[130],{"type":48,"value":82},{"type":48,"value":132},"), source code security (CodeQL), or credential scanning (CredScan).",{"type":42,"tag":86,"props":134,"children":136},{"id":135},"prerequisites",[137],{"type":48,"value":138},"Prerequisites",{"type":42,"tag":93,"props":140,"children":141},{},[142,186,203],{"type":42,"tag":97,"props":143,"children":144},{},[145,150,152,158,160],{"type":42,"tag":64,"props":146,"children":147},{},[148],{"type":48,"value":149},"BinSkim",{"type":48,"value":151},": See ",{"type":42,"tag":153,"props":154,"children":156},"a",{"href":155},"references\u002Fbinskim-install.md",[157],{"type":48,"value":155},{"type":48,"value":159}," for installation.\n",{"type":42,"tag":93,"props":161,"children":162},{},[163,175],{"type":42,"tag":97,"props":164,"children":165},{},[166,168],{"type":48,"value":167},"Windows: ",{"type":42,"tag":169,"props":170,"children":172},"code",{"className":171},[],[173],{"type":48,"value":174},"~\\.binskim\\extracted\\tools\\net9.0\\win-x64\\BinSkim.exe",{"type":42,"tag":97,"props":176,"children":177},{},[178,180],{"type":48,"value":179},"Linux: ",{"type":42,"tag":169,"props":181,"children":183},{"className":182},[],[184],{"type":48,"value":185},"~\u002F.binskim\u002Fextracted\u002Ftools\u002Fnet9.0\u002Flinux-x64\u002FBinSkim",{"type":42,"tag":97,"props":187,"children":188},{},[189,194,196,201],{"type":42,"tag":64,"props":190,"children":191},{},[192],{"type":48,"value":193},"Build toolchain",{"type":48,"value":195},": .NET SDK (managed builds). For native code: MSVC + CMake on Windows, gcc\u002Fclang + CMake on Linux. See ",{"type":42,"tag":153,"props":197,"children":199},{"href":198},"references\u002Fbuild-prereqs.md",[200],{"type":48,"value":198},{"type":48,"value":202},".",{"type":42,"tag":97,"props":204,"children":205},{},[206,211,213,219,221,227],{"type":42,"tag":64,"props":207,"children":208},{},[209],{"type":48,"value":210},"Repo cloned locally",{"type":48,"value":212},": Typically under ",{"type":42,"tag":169,"props":214,"children":216},{"className":215},[],[217],{"type":48,"value":218},"C:\\git\\\u003Crepo-name>",{"type":48,"value":220}," (Windows) or ",{"type":42,"tag":169,"props":222,"children":224},{"className":223},[],[225],{"type":48,"value":226},"~\u002Fgit\u002F\u003Crepo-name>",{"type":48,"value":228}," (Linux).",{"type":42,"tag":86,"props":230,"children":232},{"id":231},"local-scan-workflow",[233],{"type":48,"value":234},"Local Scan Workflow",{"type":42,"tag":236,"props":237,"children":239},"h3",{"id":238},"step-1-discover-pipeline-binskim-configuration",[240],{"type":48,"value":241},"Step 1: Discover Pipeline BinSkim Configuration",{"type":42,"tag":51,"props":243,"children":244},{},[245],{"type":48,"value":246},"Before scanning, read the repo's pipeline YAML to understand what the official scan targets.",{"type":42,"tag":248,"props":249,"children":250},"ol",{},[251,307,403,419],{"type":42,"tag":97,"props":252,"children":253},{},[254,259,261,267,269,275,276,282,283,289,291,297,299,305],{"type":42,"tag":64,"props":255,"children":256},{},[257],{"type":48,"value":258},"Find the pipeline YAML",{"type":48,"value":260}," — look for ",{"type":42,"tag":169,"props":262,"children":264},{"className":263},[],[265],{"type":48,"value":266},"azure-pipelines-official.yml",{"type":48,"value":268},", ",{"type":42,"tag":169,"props":270,"children":272},{"className":271},[],[273],{"type":48,"value":274},"vsts-ci.yml",{"type":48,"value":268},{"type":42,"tag":169,"props":277,"children":279},{"className":278},[],[280],{"type":48,"value":281},".vsts-ci.yml",{"type":48,"value":268},{"type":42,"tag":169,"props":284,"children":286},{"className":285},[],[287],{"type":48,"value":288},"azure-pipelines.yml",{"type":48,"value":290},", or ",{"type":42,"tag":169,"props":292,"children":294},{"className":293},[],[295],{"type":48,"value":296},".ado.yml",{"type":48,"value":298}," at the repo root or under ",{"type":42,"tag":169,"props":300,"children":302},{"className":301},[],[303],{"type":48,"value":304},"eng\u002Fpipelines\u002F",{"type":48,"value":306},". SDL is typically only in the CI\u002Fofficial pipeline, not the PR one.",{"type":42,"tag":97,"props":308,"children":309},{},[310,323,325],{"type":42,"tag":64,"props":311,"children":312},{},[313,315,321],{"type":48,"value":314},"Find the ",{"type":42,"tag":169,"props":316,"children":318},{"className":317},[],[319],{"type":48,"value":320},"sdl.binskim",{"type":48,"value":322}," section",{"type":48,"value":324},":\n",{"type":42,"tag":326,"props":327,"children":332},"pre",{"className":328,"code":329,"language":330,"meta":331,"style":331},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","sdl:\n  binskim:\n    enabled: true\n    scanOutputDirectoryOnly: true\n","yaml","",[333],{"type":42,"tag":169,"props":334,"children":335},{"__ignoreMap":331},[336,353,366,386],{"type":42,"tag":337,"props":338,"children":341},"span",{"class":339,"line":340},"line",1,[342,348],{"type":42,"tag":337,"props":343,"children":345},{"style":344},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[346],{"type":48,"value":347},"sdl",{"type":42,"tag":337,"props":349,"children":351},{"style":350},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[352],{"type":48,"value":324},{"type":42,"tag":337,"props":354,"children":356},{"class":339,"line":355},2,[357,362],{"type":42,"tag":337,"props":358,"children":359},{"style":344},[360],{"type":48,"value":361},"  binskim",{"type":42,"tag":337,"props":363,"children":364},{"style":350},[365],{"type":48,"value":324},{"type":42,"tag":337,"props":367,"children":369},{"class":339,"line":368},3,[370,375,380],{"type":42,"tag":337,"props":371,"children":372},{"style":344},[373],{"type":48,"value":374},"    enabled",{"type":42,"tag":337,"props":376,"children":377},{"style":350},[378],{"type":48,"value":379},":",{"type":42,"tag":337,"props":381,"children":383},{"style":382},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[384],{"type":48,"value":385}," true\n",{"type":42,"tag":337,"props":387,"children":389},{"class":339,"line":388},4,[390,395,399],{"type":42,"tag":337,"props":391,"children":392},{"style":344},[393],{"type":48,"value":394},"    scanOutputDirectoryOnly",{"type":42,"tag":337,"props":396,"children":397},{"style":350},[398],{"type":48,"value":379},{"type":42,"tag":337,"props":400,"children":401},{"style":382},[402],{"type":48,"value":385},{"type":42,"tag":97,"props":404,"children":405},{},[406,417],{"type":42,"tag":64,"props":407,"children":408},{},[409,411],{"type":48,"value":410},"Check for ",{"type":42,"tag":169,"props":412,"children":414},{"className":413},[],[415],{"type":48,"value":416},"sdl.binskim.additionalRunConfigParams",{"type":48,"value":418}," — custom flags\u002Fexclusions.",{"type":42,"tag":97,"props":420,"children":421},{},[422,427,428,434],{"type":42,"tag":64,"props":423,"children":424},{},[425],{"type":48,"value":426},"Identify what artifacts are published",{"type":48,"value":260},{"type":42,"tag":169,"props":429,"children":431},{"className":430},[],[432],{"type":48,"value":433},"PublishPipelineArtifact",{"type":48,"value":435}," steps. The scan targets these.",{"type":42,"tag":57,"props":437,"children":438},{},[439],{"type":42,"tag":51,"props":440,"children":441},{},[442,447],{"type":42,"tag":64,"props":443,"children":444},{},[445],{"type":48,"value":446},"Report what you find.",{"type":48,"value":448}," Tell the user: \"The official pipeline scans X with config Y. I'll reproduce that locally.\"",{"type":42,"tag":57,"props":450,"children":451},{},[452],{"type":42,"tag":51,"props":453,"children":454},{},[455,460,462,467,469,475],{"type":42,"tag":64,"props":456,"children":457},{},[458],{"type":48,"value":459},"No SDL config?",{"type":48,"value":461}," Some repos have no ",{"type":42,"tag":169,"props":463,"children":465},{"className":464},[],[466],{"type":48,"value":320},{"type":48,"value":468}," section at all. In that case, identify what the pipeline publishes as artifacts (e.g., ",{"type":42,"tag":169,"props":470,"children":472},{"className":471},[],[473],{"type":48,"value":474},"**\\bin\\Release\\**",{"type":48,"value":476},") and scan that. Note to the user: \"This repo has no explicit BinSkim\u002FSDL configuration. Scanning the published artifact directory as a best-effort approximation. Results may differ from any central SDL portal findings.\"",{"type":42,"tag":236,"props":478,"children":480},{"id":479},"step-2-build-the-repo",[481],{"type":48,"value":482},"Step 2: Build the Repo",{"type":42,"tag":51,"props":484,"children":485},{},[486,491],{"type":42,"tag":64,"props":487,"children":488},{},[489],{"type":48,"value":490},"BinSkim scans built\u002Fpackaged binaries, not source code.",{"type":48,"value":492}," You must build (and often pack) the repo.",{"type":42,"tag":326,"props":494,"children":498},{"className":495,"code":496,"language":497,"meta":331,"style":331},"language-powershell shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Windows\nbuild.cmd -c Release -pack\n\n# Linux\n.\u002Fbuild.sh -c Release -pack\n","powershell",[499],{"type":42,"tag":169,"props":500,"children":501},{"__ignoreMap":331},[502,510,518,527,535],{"type":42,"tag":337,"props":503,"children":504},{"class":339,"line":340},[505],{"type":42,"tag":337,"props":506,"children":507},{},[508],{"type":48,"value":509},"# Windows\n",{"type":42,"tag":337,"props":511,"children":512},{"class":339,"line":355},[513],{"type":42,"tag":337,"props":514,"children":515},{},[516],{"type":48,"value":517},"build.cmd -c Release -pack\n",{"type":42,"tag":337,"props":519,"children":520},{"class":339,"line":368},[521],{"type":42,"tag":337,"props":522,"children":524},{"emptyLinePlaceholder":523},true,[525],{"type":48,"value":526},"\n",{"type":42,"tag":337,"props":528,"children":529},{"class":339,"line":388},[530],{"type":42,"tag":337,"props":531,"children":532},{},[533],{"type":48,"value":534},"# Linux\n",{"type":42,"tag":337,"props":536,"children":538},{"class":339,"line":537},5,[539],{"type":42,"tag":337,"props":540,"children":541},{},[542],{"type":48,"value":543},".\u002Fbuild.sh -c Release -pack\n",{"type":42,"tag":51,"props":545,"children":546},{},[547],{"type":42,"tag":64,"props":548,"children":549},{},[550],{"type":48,"value":551},"What to build depends on pipeline config:",{"type":42,"tag":553,"props":554,"children":555},"table",{},[556,580],{"type":42,"tag":557,"props":558,"children":559},"thead",{},[560],{"type":42,"tag":561,"props":562,"children":563},"tr",{},[564,570,575],{"type":42,"tag":565,"props":566,"children":567},"th",{},[568],{"type":48,"value":569},"Pipeline config",{"type":42,"tag":565,"props":571,"children":572},{},[573],{"type":48,"value":574},"Build command",{"type":42,"tag":565,"props":576,"children":577},{},[578],{"type":48,"value":579},"Scan target",{"type":42,"tag":581,"props":582,"children":583},"tbody",{},[584,623,652,680],{"type":42,"tag":561,"props":585,"children":586},{},[587,605,614],{"type":42,"tag":588,"props":589,"children":590},"td",{},[591,597,599],{"type":42,"tag":169,"props":592,"children":594},{"className":593},[],[595],{"type":48,"value":596},"scanOutputDirectoryOnly",{"type":48,"value":598}," + publishes ",{"type":42,"tag":169,"props":600,"children":602},{"className":601},[],[603],{"type":48,"value":604},"pkgassets",{"type":42,"tag":588,"props":606,"children":607},{},[608],{"type":42,"tag":169,"props":609,"children":611},{"className":610},[],[612],{"type":48,"value":613},"build.cmd -c Release -pack",{"type":42,"tag":588,"props":615,"children":616},{},[617],{"type":42,"tag":169,"props":618,"children":620},{"className":619},[],[621],{"type":48,"value":622},"artifacts\\pkgassets\\**",{"type":42,"tag":561,"props":624,"children":625},{},[626,636,647],{"type":42,"tag":588,"props":627,"children":628},{},[629,634],{"type":42,"tag":169,"props":630,"children":632},{"className":631},[],[633],{"type":48,"value":596},{"type":48,"value":635}," + publishes NuGet packages",{"type":42,"tag":588,"props":637,"children":638},{},[639,645],{"type":42,"tag":169,"props":640,"children":642},{"className":641},[],[643],{"type":48,"value":644},"build.cmd -pack",{"type":48,"value":646}," then extract .nupkg",{"type":42,"tag":588,"props":648,"children":649},{},[650],{"type":48,"value":651},"Extracted .nupkg contents",{"type":42,"tag":561,"props":653,"children":654},{},[655,666,675],{"type":42,"tag":588,"props":656,"children":657},{},[658,660],{"type":48,"value":659},"Explicit ",{"type":42,"tag":169,"props":661,"children":663},{"className":662},[],[664],{"type":48,"value":665},"analyzeTargetGlob",{"type":42,"tag":588,"props":667,"children":668},{},[669],{"type":42,"tag":169,"props":670,"children":672},{"className":671},[],[673],{"type":48,"value":674},"build.cmd -c Release",{"type":42,"tag":588,"props":676,"children":677},{},[678],{"type":48,"value":679},"Use the glob from YAML",{"type":42,"tag":561,"props":681,"children":682},{},[683,688,696],{"type":42,"tag":588,"props":684,"children":685},{},[686],{"type":48,"value":687},"Autobaselining only",{"type":42,"tag":588,"props":689,"children":690},{},[691],{"type":42,"tag":169,"props":692,"children":694},{"className":693},[],[695],{"type":48,"value":674},{"type":42,"tag":588,"props":697,"children":698},{},[699,705],{"type":42,"tag":169,"props":700,"children":702},{"className":701},[],[703],{"type":48,"value":704},"artifacts\\bin\\**",{"type":48,"value":706}," (best guess)",{"type":42,"tag":51,"props":708,"children":709},{},[710,715,717,723],{"type":42,"tag":64,"props":711,"children":712},{},[713],{"type":48,"value":714},"Extracting .nupkg for scanning",{"type":48,"value":716}," (mirrors ",{"type":42,"tag":169,"props":718,"children":720},{"className":719},[],[721],{"type":48,"value":722},"eng\u002Fcommon\u002Fsdl\u002Fextract-artifact-packages.ps1",{"type":48,"value":724},"):",{"type":42,"tag":326,"props":726,"children":728},{"className":495,"code":727,"language":497,"meta":331,"style":331},"$nupkgDir = [System.IO.Path]::Combine(\"artifacts\", \"packages\", \"Release\", \"Shipping\")\n$extractDir = Join-Path \"artifacts\" \"extracted-for-scan\"\nAdd-Type -AssemblyName System.IO.Compression.FileSystem\nGet-ChildItem (Join-Path $nupkgDir \"*.nupkg\") | ForEach-Object {\n    $dest = Join-Path $extractDir $_.BaseName\n    New-Item -ItemType Directory -Path $dest -Force | Out-Null\n    $zip = [System.IO.Compression.ZipFile]::OpenRead($_.FullName)\n    $zip.Entries | Where-Object { $_.Name -match '\\.(dll|exe|pdb)$' } | ForEach-Object {\n        $target = Join-Path $dest $_.FullName\n        New-Item -ItemType Directory -Path (Split-Path $target) -Force | Out-Null\n        [System.IO.Compression.ZipFileExtensions]::ExtractToFile($_, $target, $true)\n    }\n    $zip.Dispose()\n}\n",[729],{"type":42,"tag":169,"props":730,"children":731},{"__ignoreMap":331},[732,740,748,756,764,772,781,790,799,808,817,826,834,843],{"type":42,"tag":337,"props":733,"children":734},{"class":339,"line":340},[735],{"type":42,"tag":337,"props":736,"children":737},{},[738],{"type":48,"value":739},"$nupkgDir = [System.IO.Path]::Combine(\"artifacts\", \"packages\", \"Release\", \"Shipping\")\n",{"type":42,"tag":337,"props":741,"children":742},{"class":339,"line":355},[743],{"type":42,"tag":337,"props":744,"children":745},{},[746],{"type":48,"value":747},"$extractDir = Join-Path \"artifacts\" \"extracted-for-scan\"\n",{"type":42,"tag":337,"props":749,"children":750},{"class":339,"line":368},[751],{"type":42,"tag":337,"props":752,"children":753},{},[754],{"type":48,"value":755},"Add-Type -AssemblyName System.IO.Compression.FileSystem\n",{"type":42,"tag":337,"props":757,"children":758},{"class":339,"line":388},[759],{"type":42,"tag":337,"props":760,"children":761},{},[762],{"type":48,"value":763},"Get-ChildItem (Join-Path $nupkgDir \"*.nupkg\") | ForEach-Object {\n",{"type":42,"tag":337,"props":765,"children":766},{"class":339,"line":537},[767],{"type":42,"tag":337,"props":768,"children":769},{},[770],{"type":48,"value":771},"    $dest = Join-Path $extractDir $_.BaseName\n",{"type":42,"tag":337,"props":773,"children":775},{"class":339,"line":774},6,[776],{"type":42,"tag":337,"props":777,"children":778},{},[779],{"type":48,"value":780},"    New-Item -ItemType Directory -Path $dest -Force | Out-Null\n",{"type":42,"tag":337,"props":782,"children":784},{"class":339,"line":783},7,[785],{"type":42,"tag":337,"props":786,"children":787},{},[788],{"type":48,"value":789},"    $zip = [System.IO.Compression.ZipFile]::OpenRead($_.FullName)\n",{"type":42,"tag":337,"props":791,"children":793},{"class":339,"line":792},8,[794],{"type":42,"tag":337,"props":795,"children":796},{},[797],{"type":48,"value":798},"    $zip.Entries | Where-Object { $_.Name -match '\\.(dll|exe|pdb)$' } | ForEach-Object {\n",{"type":42,"tag":337,"props":800,"children":802},{"class":339,"line":801},9,[803],{"type":42,"tag":337,"props":804,"children":805},{},[806],{"type":48,"value":807},"        $target = Join-Path $dest $_.FullName\n",{"type":42,"tag":337,"props":809,"children":811},{"class":339,"line":810},10,[812],{"type":42,"tag":337,"props":813,"children":814},{},[815],{"type":48,"value":816},"        New-Item -ItemType Directory -Path (Split-Path $target) -Force | Out-Null\n",{"type":42,"tag":337,"props":818,"children":820},{"class":339,"line":819},11,[821],{"type":42,"tag":337,"props":822,"children":823},{},[824],{"type":48,"value":825},"        [System.IO.Compression.ZipFileExtensions]::ExtractToFile($_, $target, $true)\n",{"type":42,"tag":337,"props":827,"children":828},{"class":339,"line":25},[829],{"type":42,"tag":337,"props":830,"children":831},{},[832],{"type":48,"value":833},"    }\n",{"type":42,"tag":337,"props":835,"children":837},{"class":339,"line":836},13,[838],{"type":42,"tag":337,"props":839,"children":840},{},[841],{"type":48,"value":842},"    $zip.Dispose()\n",{"type":42,"tag":337,"props":844,"children":846},{"class":339,"line":845},14,[847],{"type":42,"tag":337,"props":848,"children":849},{},[850],{"type":48,"value":851},"}\n",{"type":42,"tag":57,"props":853,"children":854},{},[855],{"type":42,"tag":51,"props":856,"children":857},{},[858,860,865],{"type":48,"value":859},"Only extract ",{"type":42,"tag":64,"props":861,"children":862},{},[863],{"type":48,"value":864},"Shipping",{"type":48,"value":866}," packages unless you have reason to scan NonShipping too.",{"type":42,"tag":57,"props":868,"children":869},{},[870,885],{"type":42,"tag":51,"props":871,"children":872},{},[873,878,880,884],{"type":42,"tag":64,"props":874,"children":875},{},[876],{"type":48,"value":877},"Native builds may require extra setup.",{"type":48,"value":879}," If native code fails to build, you can still scan pre-built native DLLs from the NuGet cache. Many rules (including BA2008) don't need PDBs. See ",{"type":42,"tag":153,"props":881,"children":882},{"href":198},[883],{"type":48,"value":198},{"type":48,"value":202},{"type":42,"tag":51,"props":886,"children":887},{},[888,893],{"type":42,"tag":64,"props":889,"children":890},{},[891],{"type":48,"value":892},"NuGet cache limitation",{"type":48,"value":894},": This only covers third-party native blobs consumed via NuGet. It misses first-party native code compiled from source, managed assemblies the repo builds, and pack-only artifacts. For repos where all findings are on NuGet-sourced binaries (e.g., machinelearning's Intel DLLs), this is sufficient. For repos that compile native code from source, a full build is needed.",{"type":42,"tag":236,"props":896,"children":898},{"id":897},"step-3-run-binskim",[899],{"type":48,"value":900},"Step 3: Run BinSkim",{"type":42,"tag":51,"props":902,"children":903},{},[904,909,911,917],{"type":42,"tag":64,"props":905,"children":906},{},[907],{"type":48,"value":908},"Preferred: Use the helper script",{"type":48,"value":910}," (from the skill's ",{"type":42,"tag":169,"props":912,"children":914},{"className":913},[],[915],{"type":48,"value":916},"scripts\u002F",{"type":48,"value":918}," directory, or provide its full path):",{"type":42,"tag":326,"props":920,"children":922},{"className":495,"code":921,"language":497,"meta":331,"style":331},"$script = [System.IO.Path]::Combine(\"plugins\", \"dotnet-dnceng\", \"skills\", \"binskim-scan\", \"scripts\", \"Invoke-BinSkimScan.ps1\")\n\n# Scan a directory:\n& $script -RepoRoot C:\\git\\machinelearning -ScanDir (Join-Path \"artifacts\" \"pkgassets\")\n\n# Filter to portal-reported rules only:\n& $script -RepoRoot C:\\git\\machinelearning -ScanDir (Join-Path \"artifacts\" \"pkgassets\") -PortalRulesFrom C:\\temp\\Results.sarif\n\n# Auto-discover scan targets:\n& $script -RepoRoot C:\\git\\machinelearning\n",[923],{"type":42,"tag":169,"props":924,"children":925},{"__ignoreMap":331},[926,934,941,949,957,964,972,980,987,995],{"type":42,"tag":337,"props":927,"children":928},{"class":339,"line":340},[929],{"type":42,"tag":337,"props":930,"children":931},{},[932],{"type":48,"value":933},"$script = [System.IO.Path]::Combine(\"plugins\", \"dotnet-dnceng\", \"skills\", \"binskim-scan\", \"scripts\", \"Invoke-BinSkimScan.ps1\")\n",{"type":42,"tag":337,"props":935,"children":936},{"class":339,"line":355},[937],{"type":42,"tag":337,"props":938,"children":939},{"emptyLinePlaceholder":523},[940],{"type":48,"value":526},{"type":42,"tag":337,"props":942,"children":943},{"class":339,"line":368},[944],{"type":42,"tag":337,"props":945,"children":946},{},[947],{"type":48,"value":948},"# Scan a directory:\n",{"type":42,"tag":337,"props":950,"children":951},{"class":339,"line":388},[952],{"type":42,"tag":337,"props":953,"children":954},{},[955],{"type":48,"value":956},"& $script -RepoRoot C:\\git\\machinelearning -ScanDir (Join-Path \"artifacts\" \"pkgassets\")\n",{"type":42,"tag":337,"props":958,"children":959},{"class":339,"line":537},[960],{"type":42,"tag":337,"props":961,"children":962},{"emptyLinePlaceholder":523},[963],{"type":48,"value":526},{"type":42,"tag":337,"props":965,"children":966},{"class":339,"line":774},[967],{"type":42,"tag":337,"props":968,"children":969},{},[970],{"type":48,"value":971},"# Filter to portal-reported rules only:\n",{"type":42,"tag":337,"props":973,"children":974},{"class":339,"line":783},[975],{"type":42,"tag":337,"props":976,"children":977},{},[978],{"type":48,"value":979},"& $script -RepoRoot C:\\git\\machinelearning -ScanDir (Join-Path \"artifacts\" \"pkgassets\") -PortalRulesFrom C:\\temp\\Results.sarif\n",{"type":42,"tag":337,"props":981,"children":982},{"class":339,"line":792},[983],{"type":42,"tag":337,"props":984,"children":985},{"emptyLinePlaceholder":523},[986],{"type":48,"value":526},{"type":42,"tag":337,"props":988,"children":989},{"class":339,"line":801},[990],{"type":42,"tag":337,"props":991,"children":992},{},[993],{"type":48,"value":994},"# Auto-discover scan targets:\n",{"type":42,"tag":337,"props":996,"children":997},{"class":339,"line":810},[998],{"type":42,"tag":337,"props":999,"children":1000},{},[1001],{"type":48,"value":1002},"& $script -RepoRoot C:\\git\\machinelearning\n",{"type":42,"tag":51,"props":1004,"children":1005},{},[1006],{"type":42,"tag":64,"props":1007,"children":1008},{},[1009],{"type":48,"value":1010},"Manual invocation:",{"type":42,"tag":326,"props":1012,"children":1014},{"className":495,"code":1013,"language":497,"meta":331,"style":331},"# Adjust path to your platform – see binskim-install.md for installation\n$binskim = [System.IO.Path]::Combine($HOME, \".binskim\", \"tools\", \"net9.0\", \"linux-x64\", \"BinSkim\")   # Linux\n# $binskim = [System.IO.Path]::Combine($HOME, \".binskim\", \"tools\", \"net9.0\", \"win-x64\", \"BinSkim.exe\") # Windows\n$targetGlob = Join-Path \"artifacts\" \"pkgassets\" \"**\"\n& $binskim analyze $targetGlob --recurse --output binskim-results.sarif --log PrettyPrint --force --Hashes False\n",[1015],{"type":42,"tag":169,"props":1016,"children":1017},{"__ignoreMap":331},[1018,1026,1034,1042,1050],{"type":42,"tag":337,"props":1019,"children":1020},{"class":339,"line":340},[1021],{"type":42,"tag":337,"props":1022,"children":1023},{},[1024],{"type":48,"value":1025},"# Adjust path to your platform – see binskim-install.md for installation\n",{"type":42,"tag":337,"props":1027,"children":1028},{"class":339,"line":355},[1029],{"type":42,"tag":337,"props":1030,"children":1031},{},[1032],{"type":48,"value":1033},"$binskim = [System.IO.Path]::Combine($HOME, \".binskim\", \"tools\", \"net9.0\", \"linux-x64\", \"BinSkim\")   # Linux\n",{"type":42,"tag":337,"props":1035,"children":1036},{"class":339,"line":368},[1037],{"type":42,"tag":337,"props":1038,"children":1039},{},[1040],{"type":48,"value":1041},"# $binskim = [System.IO.Path]::Combine($HOME, \".binskim\", \"tools\", \"net9.0\", \"win-x64\", \"BinSkim.exe\") # Windows\n",{"type":42,"tag":337,"props":1043,"children":1044},{"class":339,"line":388},[1045],{"type":42,"tag":337,"props":1046,"children":1047},{},[1048],{"type":48,"value":1049},"$targetGlob = Join-Path \"artifacts\" \"pkgassets\" \"**\"\n",{"type":42,"tag":337,"props":1051,"children":1052},{"class":339,"line":537},[1053],{"type":42,"tag":337,"props":1054,"children":1055},{},[1056],{"type":48,"value":1057},"& $binskim analyze $targetGlob --recurse --output binskim-results.sarif --log PrettyPrint --force --Hashes False\n",{"type":42,"tag":57,"props":1059,"children":1060},{},[1061],{"type":42,"tag":51,"props":1062,"children":1063},{},[1064,1077,1079,1085,1087,1093,1094,1100,1101,1107,1108,1114],{"type":42,"tag":64,"props":1065,"children":1066},{},[1067,1069,1075],{"type":48,"value":1068},"Don't filter to ",{"type":42,"tag":169,"props":1070,"children":1072},{"className":1071},[],[1073],{"type":48,"value":1074},"*.dll",{"type":48,"value":1076}," only",{"type":48,"value":1078}," — scan ",{"type":42,"tag":169,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":48,"value":1084},"**",{"type":48,"value":1086}," and let BinSkim decide what's analyzable. This catches ",{"type":42,"tag":169,"props":1088,"children":1090},{"className":1089},[],[1091],{"type":48,"value":1092},".exe",{"type":48,"value":268},{"type":42,"tag":169,"props":1095,"children":1097},{"className":1096},[],[1098],{"type":48,"value":1099},".sys",{"type":48,"value":268},{"type":42,"tag":169,"props":1102,"children":1104},{"className":1103},[],[1105],{"type":48,"value":1106},".so",{"type":48,"value":268},{"type":42,"tag":169,"props":1109,"children":1111},{"className":1110},[],[1112],{"type":48,"value":1113},".dylib",{"type":48,"value":1115},", and extensionless Mach-O executables. BinSkim identifies binary format by magic bytes, not file extension.",{"type":42,"tag":236,"props":1117,"children":1119},{"id":1118},"step-4-analyze-results",[1120],{"type":48,"value":1121},"Step 4: Analyze Results",{"type":42,"tag":326,"props":1123,"children":1125},{"className":495,"code":1124,"language":497,"meta":331,"style":331},"$sarif = Get-Content -Raw binskim-results.sarif | ConvertFrom-Json\n# IMPORTANT: Results.sarif may have multiple runs (BinSkim, roslynanalyzers, etc.)\n# Filter to the BinSkim run by tool name — don't assume runs[0]\n$binskimRun = $sarif.runs | Where-Object { $_.tool.driver.name -like '*BinSkim*' } | Select-Object -First 1\nif (-not $binskimRun) { $binskimRun = $sarif.runs[0] }  # fallback\n$results = $binskimRun.results\n$errors = $results | Where-Object { $_.level -eq 'error' }\n$warnings = $results | Where-Object { $_.level -eq 'warning' }\nWrite-Host \"Errors: $($errors.Count), Warnings: $($warnings.Count)\"\n$errors | Group-Object ruleId | Sort-Object Count -Descending | Format-Table Count, Name\n",[1126],{"type":42,"tag":169,"props":1127,"children":1128},{"__ignoreMap":331},[1129,1137,1145,1153,1161,1169,1177,1185,1193,1201],{"type":42,"tag":337,"props":1130,"children":1131},{"class":339,"line":340},[1132],{"type":42,"tag":337,"props":1133,"children":1134},{},[1135],{"type":48,"value":1136},"$sarif = Get-Content -Raw binskim-results.sarif | ConvertFrom-Json\n",{"type":42,"tag":337,"props":1138,"children":1139},{"class":339,"line":355},[1140],{"type":42,"tag":337,"props":1141,"children":1142},{},[1143],{"type":48,"value":1144},"# IMPORTANT: Results.sarif may have multiple runs (BinSkim, roslynanalyzers, etc.)\n",{"type":42,"tag":337,"props":1146,"children":1147},{"class":339,"line":368},[1148],{"type":42,"tag":337,"props":1149,"children":1150},{},[1151],{"type":48,"value":1152},"# Filter to the BinSkim run by tool name — don't assume runs[0]\n",{"type":42,"tag":337,"props":1154,"children":1155},{"class":339,"line":388},[1156],{"type":42,"tag":337,"props":1157,"children":1158},{},[1159],{"type":48,"value":1160},"$binskimRun = $sarif.runs | Where-Object { $_.tool.driver.name -like '*BinSkim*' } | Select-Object -First 1\n",{"type":42,"tag":337,"props":1162,"children":1163},{"class":339,"line":537},[1164],{"type":42,"tag":337,"props":1165,"children":1166},{},[1167],{"type":48,"value":1168},"if (-not $binskimRun) { $binskimRun = $sarif.runs[0] }  # fallback\n",{"type":42,"tag":337,"props":1170,"children":1171},{"class":339,"line":774},[1172],{"type":42,"tag":337,"props":1173,"children":1174},{},[1175],{"type":48,"value":1176},"$results = $binskimRun.results\n",{"type":42,"tag":337,"props":1178,"children":1179},{"class":339,"line":783},[1180],{"type":42,"tag":337,"props":1181,"children":1182},{},[1183],{"type":48,"value":1184},"$errors = $results | Where-Object { $_.level -eq 'error' }\n",{"type":42,"tag":337,"props":1186,"children":1187},{"class":339,"line":792},[1188],{"type":42,"tag":337,"props":1189,"children":1190},{},[1191],{"type":48,"value":1192},"$warnings = $results | Where-Object { $_.level -eq 'warning' }\n",{"type":42,"tag":337,"props":1194,"children":1195},{"class":339,"line":801},[1196],{"type":42,"tag":337,"props":1197,"children":1198},{},[1199],{"type":48,"value":1200},"Write-Host \"Errors: $($errors.Count), Warnings: $($warnings.Count)\"\n",{"type":42,"tag":337,"props":1202,"children":1203},{"class":339,"line":810},[1204],{"type":42,"tag":337,"props":1205,"children":1206},{},[1207],{"type":48,"value":1208},"$errors | Group-Object ruleId | Sort-Object Count -Descending | Format-Table Count, Name\n",{"type":42,"tag":51,"props":1210,"children":1211},{},[1212],{"type":42,"tag":64,"props":1213,"children":1214},{},[1215],{"type":48,"value":1216},"Present results as:",{"type":42,"tag":248,"props":1218,"children":1219},{},[1220,1225,1230],{"type":42,"tag":97,"props":1221,"children":1222},{},[1223],{"type":48,"value":1224},"Summary table: rule ID, count, severity",{"type":42,"tag":97,"props":1226,"children":1227},{},[1228],{"type":48,"value":1229},"Per-binary breakdown for errors",{"type":42,"tag":97,"props":1231,"children":1232},{},[1233],{"type":48,"value":1234},"For each finding: first-party (built in repo) or third-party (from NuGet)?",{"type":42,"tag":236,"props":1236,"children":1238},{"id":1237},"step-5-compare-with-official-results-if-applicable",[1239],{"type":48,"value":1240},"Step 5: Compare with Official Results (if applicable)",{"type":42,"tag":51,"props":1242,"children":1243},{},[1244],{"type":48,"value":1245},"If the user provides official results, map findings and flag:",{"type":42,"tag":93,"props":1247,"children":1248},{},[1249,1259],{"type":42,"tag":97,"props":1250,"children":1251},{},[1252,1257],{"type":42,"tag":64,"props":1253,"children":1254},{},[1255],{"type":48,"value":1256},"Gaps",{"type":48,"value":1258},": findings in official but not local (packaging differences)",{"type":42,"tag":97,"props":1260,"children":1261},{},[1262,1267],{"type":42,"tag":64,"props":1263,"children":1264},{},[1265],{"type":48,"value":1266},"Extras",{"type":48,"value":1268},": findings local but not official (scanning too broadly, or Guardian filtering)",{"type":42,"tag":51,"props":1270,"children":1271},{},[1272,1274,1278,1280,1286],{"type":48,"value":1273},"Local scans are a ",{"type":42,"tag":64,"props":1275,"children":1276},{},[1277],{"type":48,"value":75},{"type":48,"value":1279}," — more findings than the portal is expected. Use ",{"type":42,"tag":169,"props":1281,"children":1283},{"className":1282},[],[1284],{"type":48,"value":1285},"-PortalRulesFrom",{"type":48,"value":1287}," to filter local results to match portal rules.",{"type":42,"tag":86,"props":1289,"children":1291},{"id":1290},"cross-platform",[1292],{"type":48,"value":1293},"Cross-Platform",{"type":42,"tag":51,"props":1295,"children":1296},{},[1297],{"type":48,"value":1298},"BinSkim ships for Windows, Linux (x64, arm64), and macOS (x64):",{"type":42,"tag":93,"props":1300,"children":1301},{},[1302,1312,1332],{"type":42,"tag":97,"props":1303,"children":1304},{},[1305,1306],{"type":48,"value":167},{"type":42,"tag":169,"props":1307,"children":1309},{"className":1308},[],[1310],{"type":48,"value":1311},"tools\u002Fnet9.0\u002Fwin-x64\u002FBinSkim.exe",{"type":42,"tag":97,"props":1313,"children":1314},{},[1315,1316,1322,1324,1330],{"type":48,"value":179},{"type":42,"tag":169,"props":1317,"children":1319},{"className":1318},[],[1320],{"type":48,"value":1321},"tools\u002Fnet9.0\u002Flinux-x64\u002FBinSkim",{"type":48,"value":1323}," (",{"type":42,"tag":169,"props":1325,"children":1327},{"className":1326},[],[1328],{"type":48,"value":1329},"chmod +x",{"type":48,"value":1331},")",{"type":42,"tag":97,"props":1333,"children":1334},{},[1335,1337,1343],{"type":48,"value":1336},"macOS: ",{"type":42,"tag":169,"props":1338,"children":1340},{"className":1339},[],[1341],{"type":48,"value":1342},"tools\u002Fnet9.0\u002Fosx-x64\u002FBinSkim",{"type":48,"value":1344}," (x64 only — no arm64 runtime in package; use Rosetta on Apple Silicon)",{"type":42,"tag":51,"props":1346,"children":1347},{},[1348,1353],{"type":42,"tag":64,"props":1349,"children":1350},{},[1351],{"type":48,"value":1352},"Each OS build produces different native binaries with potentially different BinSkim findings.",{"type":48,"value":1354}," If the repo ships native binaries for multiple platforms, you need to scan binaries from each target OS — not just Windows.",{"type":42,"tag":51,"props":1356,"children":1357},{},[1358,1360,1366],{"type":48,"value":1359},"Use ",{"type":42,"tag":169,"props":1361,"children":1363},{"className":1362},[],[1364],{"type":48,"value":1365},"build.sh",{"type":48,"value":1367}," on Linux\u002FmacOS to build for those platforms. If the official pipeline only runs BinSkim on Windows legs, flag this as a coverage gap — the pipeline should scan all OS configurations that produce shipped native artifacts.",{"type":42,"tag":236,"props":1369,"children":1371},{"id":1370},"cross-platform-scanning-any-binary-on-any-os",[1372],{"type":48,"value":1373},"Cross-platform scanning — any binary on any OS",{"type":42,"tag":51,"props":1375,"children":1376},{},[1377,1382,1384,1389,1391,1396],{"type":42,"tag":64,"props":1378,"children":1379},{},[1380],{"type":48,"value":1381},"BinSkim can scan PE, ELF, and Mach-O binaries on any OS.",{"type":48,"value":1383}," BinSkim identifies binary format by magic bytes (not file extension or host OS). The Windows build can analyze Linux ",{"type":42,"tag":169,"props":1385,"children":1387},{"className":1386},[],[1388],{"type":48,"value":1106},{"type":48,"value":1390}," files and macOS ",{"type":42,"tag":169,"props":1392,"children":1394},{"className":1393},[],[1395],{"type":48,"value":1113},{"type":48,"value":1397}," files, and vice versa. All the binary parsing is pure managed code with no platform-specific dependencies.",{"type":42,"tag":51,"props":1399,"children":1400},{},[1401],{"type":48,"value":1402},"This means you can:",{"type":42,"tag":93,"props":1404,"children":1405},{},[1406,1418,1429],{"type":42,"tag":97,"props":1407,"children":1408},{},[1409,1411,1416],{"type":48,"value":1410},"Scan macOS ",{"type":42,"tag":169,"props":1412,"children":1414},{"className":1413},[],[1415],{"type":48,"value":1113},{"type":48,"value":1417}," files on a Windows dev machine",{"type":42,"tag":97,"props":1419,"children":1420},{},[1421,1423,1428],{"type":48,"value":1422},"Scan Linux ",{"type":42,"tag":169,"props":1424,"children":1426},{"className":1425},[],[1427],{"type":48,"value":1106},{"type":48,"value":1417},{"type":42,"tag":97,"props":1430,"children":1431},{},[1432],{"type":48,"value":1433},"Download official build artifacts from any platform and scan them locally, regardless of your OS",{"type":42,"tag":51,"props":1435,"children":1436},{},[1437,1442,1444,1449,1451,1456,1458,1463,1465,1470,1472,1477,1479,1485],{"type":42,"tag":64,"props":1438,"children":1439},{},[1440],{"type":48,"value":1441},"The key requirement is passing the right file patterns.",{"type":48,"value":1443}," BinSkim discovers files via glob patterns you supply (e.g., ",{"type":42,"tag":169,"props":1445,"children":1447},{"className":1446},[],[1448],{"type":48,"value":1074},{"type":48,"value":1450},"). If you only pass ",{"type":42,"tag":169,"props":1452,"children":1454},{"className":1453},[],[1455],{"type":48,"value":1074},{"type":48,"value":1457},", it won't find ",{"type":42,"tag":169,"props":1459,"children":1461},{"className":1460},[],[1462],{"type":48,"value":1113},{"type":48,"value":1464}," or ",{"type":42,"tag":169,"props":1466,"children":1468},{"className":1467},[],[1469],{"type":48,"value":1106},{"type":48,"value":1471}," files — not because it can't analyze them, but because the glob doesn't match. Use ",{"type":42,"tag":169,"props":1473,"children":1475},{"className":1474},[],[1476],{"type":48,"value":1084},{"type":48,"value":1478}," (all files) or explicit patterns like ",{"type":42,"tag":169,"props":1480,"children":1482},{"className":1481},[],[1483],{"type":48,"value":1484},"*.dylib *.so",{"type":48,"value":1486}," to scan non-PE binaries.",{"type":42,"tag":57,"props":1488,"children":1489},{},[1490],{"type":42,"tag":51,"props":1491,"children":1492},{},[1493,1498,1500,1506,1507,1512,1513,1518],{"type":42,"tag":64,"props":1494,"children":1495},{},[1496],{"type":48,"value":1497},"Why do official pipelines miss non-Windows binaries?",{"type":48,"value":1499}," The 1ES\u002FGuardian SDL template invokes BinSkim with Windows-centric glob patterns (matching ",{"type":42,"tag":169,"props":1501,"children":1503},{"className":1502},[],[1504],{"type":48,"value":1505},".dll",{"type":48,"value":268},{"type":42,"tag":169,"props":1508,"children":1510},{"className":1509},[],[1511],{"type":48,"value":1092},{"type":48,"value":268},{"type":42,"tag":169,"props":1514,"children":1516},{"className":1515},[],[1517],{"type":48,"value":1099},{"type":48,"value":1519},"). Mach-O and ELF binaries are never enumerated — they aren't \"rejected\", they're simply never passed to BinSkim. This is a configuration gap in how the pipeline invokes BinSkim, not a BinSkim limitation.",{"type":42,"tag":236,"props":1521,"children":1523},{"id":1522},"scanning-downloaded-official-artifacts",[1524],{"type":48,"value":1525},"Scanning downloaded official artifacts",{"type":42,"tag":51,"props":1527,"children":1528},{},[1529],{"type":48,"value":1530},"There are two main scenarios for local BinSkim scanning:",{"type":42,"tag":93,"props":1532,"children":1533},{},[1534,1544],{"type":42,"tag":97,"props":1535,"children":1536},{},[1537,1542],{"type":42,"tag":64,"props":1538,"children":1539},{},[1540],{"type":48,"value":1541},"Verifying a local fix",{"type":48,"value":1543},": Build the repo (or sub-repo) locally and scan the output. This is the normal workflow.",{"type":42,"tag":97,"props":1545,"children":1546},{},[1547,1552],{"type":42,"tag":64,"props":1548,"children":1549},{},[1550],{"type":48,"value":1551},"Analyzing platforms not covered by official SDL",{"type":48,"value":1553},": If official runs don't scan certain platforms (e.g., Linux\u002FmacOS binaries), you can download official build artifacts and scan them locally on any OS — BinSkim can analyze PE, ELF, and Mach-O binaries on any platform. This is also useful for initial triage before fixing anything.",{"type":42,"tag":51,"props":1555,"children":1556},{},[1557,1559,1564],{"type":48,"value":1558},"For the artifact download approach, official BinSkim and Guardian SARIF files from the SDL artifacts give you the same information without re-scanning. Re-scanning downloaded artifacts is only needed when official SDL doesn't cover a platform. BinSkim can analyze binaries from any platform on any OS, so you don't need a macOS machine to scan ",{"type":42,"tag":169,"props":1560,"children":1562},{"className":1561},[],[1563],{"type":48,"value":1113},{"type":48,"value":1565}," files.",{"type":42,"tag":51,"props":1567,"children":1568},{},[1569],{"type":48,"value":1570},"To scan downloaded artifacts:",{"type":42,"tag":248,"props":1572,"children":1573},{},[1574,1592,1652,1685],{"type":42,"tag":97,"props":1575,"children":1576},{},[1577,1582,1584,1590],{"type":42,"tag":64,"props":1578,"children":1579},{},[1580],{"type":48,"value":1581},"Download build artifacts",{"type":48,"value":1583}," from AzDO (use ",{"type":42,"tag":169,"props":1585,"children":1587},{"className":1586},[],[1588],{"type":48,"value":1589},"ado-dnceng-pipelines_download_artifact",{"type":48,"value":1591}," or REST API)",{"type":42,"tag":97,"props":1593,"children":1594},{},[1595,1600,1602,1608,1610,1616,1618],{"type":42,"tag":64,"props":1596,"children":1597},{},[1598],{"type":48,"value":1599},"Extract native binaries",{"type":48,"value":1601}," — artifacts often contain ",{"type":42,"tag":169,"props":1603,"children":1605},{"className":1604},[],[1606],{"type":48,"value":1607},".tar.gz",{"type":48,"value":1609}," inside ",{"type":42,"tag":169,"props":1611,"children":1613},{"className":1612},[],[1614],{"type":48,"value":1615},".nupkg",{"type":48,"value":1617}," or zip files\n",{"type":42,"tag":93,"props":1619,"children":1620},{},[1621,1641],{"type":42,"tag":97,"props":1622,"children":1623},{},[1624,1626,1631,1633,1639],{"type":48,"value":1625},"For ",{"type":42,"tag":169,"props":1627,"children":1629},{"className":1628},[],[1630],{"type":48,"value":1607},{"type":48,"value":1632}," extraction: use ",{"type":42,"tag":169,"props":1634,"children":1636},{"className":1635},[],[1637],{"type":48,"value":1638},"tar.exe",{"type":48,"value":1640}," (built into Windows 10+) or 7-Zip",{"type":42,"tag":97,"props":1642,"children":1643},{},[1644,1646],{"type":48,"value":1645},"PowerShell 7.4+ on .NET 8+ also supports tar via ",{"type":42,"tag":169,"props":1647,"children":1649},{"className":1648},[],[1650],{"type":48,"value":1651},"[System.Formats.Tar.TarFile]::ExtractToDirectory()",{"type":42,"tag":97,"props":1653,"children":1654},{},[1655,1660,1662,1668,1670,1676,1678,1684],{"type":42,"tag":64,"props":1656,"children":1657},{},[1658],{"type":48,"value":1659},"Identify native binaries",{"type":48,"value":1661}," by file header magic bytes (ELF: ",{"type":42,"tag":169,"props":1663,"children":1665},{"className":1664},[],[1666],{"type":48,"value":1667},"\\x7fELF",{"type":48,"value":1669},", Mach-O: ",{"type":42,"tag":169,"props":1671,"children":1673},{"className":1672},[],[1674],{"type":48,"value":1675},"\\xfe\\xed\\xfa\\xce",{"type":48,"value":1677},"\u002F",{"type":42,"tag":169,"props":1679,"children":1681},{"className":1680},[],[1682],{"type":48,"value":1683},"\\xcf\\xfa\\xed\\xfe",{"type":48,"value":1331},{"type":42,"tag":97,"props":1686,"children":1687},{},[1688,1693],{"type":42,"tag":64,"props":1689,"children":1690},{},[1691],{"type":48,"value":1692},"Scan with BinSkim",{"type":48,"value":1694}," using the appropriate platform binary",{"type":42,"tag":86,"props":1696,"children":1698},{"id":1697},"beforeafter-comparison",[1699],{"type":48,"value":1700},"Before\u002FAfter Comparison",{"type":42,"tag":51,"props":1702,"children":1703},{},[1704],{"type":48,"value":1705},"To prove a fix works, scan before and after:",{"type":42,"tag":326,"props":1707,"children":1709},{"className":495,"code":1708,"language":497,"meta":331,"style":331},"# Baseline on main, then fix branch\n$before = (Get-Content -Raw binskim-before.sarif | ConvertFrom-Json).runs[0].results | Where-Object { $_.level -eq 'error' }\n$after  = (Get-Content -Raw binskim-after.sarif  | ConvertFrom-Json).runs[0].results | Where-Object { $_.level -eq 'error' }\nWrite-Host \"Before: $($before.Count) errors, After: $($after.Count) errors\"\n",[1710],{"type":42,"tag":169,"props":1711,"children":1712},{"__ignoreMap":331},[1713,1721,1729,1737],{"type":42,"tag":337,"props":1714,"children":1715},{"class":339,"line":340},[1716],{"type":42,"tag":337,"props":1717,"children":1718},{},[1719],{"type":48,"value":1720},"# Baseline on main, then fix branch\n",{"type":42,"tag":337,"props":1722,"children":1723},{"class":339,"line":355},[1724],{"type":42,"tag":337,"props":1725,"children":1726},{},[1727],{"type":48,"value":1728},"$before = (Get-Content -Raw binskim-before.sarif | ConvertFrom-Json).runs[0].results | Where-Object { $_.level -eq 'error' }\n",{"type":42,"tag":337,"props":1730,"children":1731},{"class":339,"line":368},[1732],{"type":42,"tag":337,"props":1733,"children":1734},{},[1735],{"type":48,"value":1736},"$after  = (Get-Content -Raw binskim-after.sarif  | ConvertFrom-Json).runs[0].results | Where-Object { $_.level -eq 'error' }\n",{"type":42,"tag":337,"props":1738,"children":1739},{"class":339,"line":388},[1740],{"type":42,"tag":337,"props":1741,"children":1742},{},[1743],{"type":48,"value":1744},"Write-Host \"Before: $($before.Count) errors, After: $($after.Count) errors\"\n",{"type":42,"tag":57,"props":1746,"children":1747},{},[1748],{"type":42,"tag":51,"props":1749,"children":1750},{},[1751],{"type":48,"value":1752},"This requires two full builds. Only use when the user needs proof a fix works.",{"type":42,"tag":86,"props":1754,"children":1756},{"id":1755},"fix-strategies",[1757],{"type":48,"value":1758},"Fix Strategies",{"type":42,"tag":236,"props":1760,"children":1762},{"id":1761},"classify-the-finding-first",[1763],{"type":48,"value":1764},"Classify the finding first",{"type":42,"tag":248,"props":1766,"children":1767},{},[1768,1773,1786],{"type":42,"tag":97,"props":1769,"children":1770},{},[1771],{"type":48,"value":1772},"Search the repo for the binary name — is there a project that produces it?",{"type":42,"tag":97,"props":1774,"children":1775},{},[1776,1778,1784],{"type":48,"value":1777},"Check NuGet packages — is it from a ",{"type":42,"tag":169,"props":1779,"children":1781},{"className":1780},[],[1782],{"type":48,"value":1783},"PackageReference",{"type":48,"value":1785},"?",{"type":42,"tag":97,"props":1787,"children":1788},{},[1789,1790,1796],{"type":48,"value":410},{"type":42,"tag":169,"props":1791,"children":1793},{"className":1792},[],[1794],{"type":48,"value":1795},"\u003CContent Include=\"...\">",{"type":48,"value":1797}," — is it a pre-built file being copied?",{"type":42,"tag":236,"props":1799,"children":1801},{"id":1800},"fix-by-origin",[1802],{"type":48,"value":1803},"Fix by origin",{"type":42,"tag":553,"props":1805,"children":1806},{},[1807,1828],{"type":42,"tag":557,"props":1808,"children":1809},{},[1810],{"type":42,"tag":561,"props":1811,"children":1812},{},[1813,1818,1823],{"type":42,"tag":565,"props":1814,"children":1815},{},[1816],{"type":48,"value":1817},"Binary origin",{"type":42,"tag":565,"props":1819,"children":1820},{},[1821],{"type":48,"value":1822},"Example",{"type":42,"tag":565,"props":1824,"children":1825},{},[1826],{"type":48,"value":1827},"Fix approach",{"type":42,"tag":581,"props":1829,"children":1830},{},[1831,1867,1888,1909],{"type":42,"tag":561,"props":1832,"children":1833},{},[1834,1850,1855],{"type":42,"tag":588,"props":1835,"children":1836},{},[1837,1842,1843,1849],{"type":42,"tag":64,"props":1838,"children":1839},{},[1840],{"type":48,"value":1841},"C++ source",{"type":48,"value":1323},{"type":42,"tag":169,"props":1844,"children":1846},{"className":1845},[],[1847],{"type":48,"value":1848},".vcxproj",{"type":48,"value":1331},{"type":42,"tag":588,"props":1851,"children":1852},{},[1853],{"type":48,"value":1854},"EtwClrProfiler.dll",{"type":42,"tag":588,"props":1856,"children":1857},{},[1858,1860,1866],{"type":48,"value":1859},"Add compiler\u002Flinker flags (e.g., ",{"type":42,"tag":169,"props":1861,"children":1863},{"className":1862},[],[1864],{"type":48,"value":1865},"\u002Fguard:cf",{"type":48,"value":1331},{"type":42,"tag":561,"props":1868,"children":1869},{},[1870,1878,1883],{"type":42,"tag":588,"props":1871,"children":1872},{},[1873],{"type":42,"tag":64,"props":1874,"children":1875},{},[1876],{"type":48,"value":1877},"Pre-built native from NuGet",{"type":42,"tag":588,"props":1879,"children":1880},{},[1881],{"type":48,"value":1882},"Intel MKL\u002FTBB, WiX winterop.dll",{"type":42,"tag":588,"props":1884,"children":1885},{},[1886],{"type":48,"value":1887},"Cannot fix here — update package, file upstream, or suppress",{"type":42,"tag":561,"props":1889,"children":1890},{},[1891,1899,1904],{"type":42,"tag":588,"props":1892,"children":1893},{},[1894],{"type":42,"tag":64,"props":1895,"children":1896},{},[1897],{"type":48,"value":1898},"Test framework",{"type":42,"tag":588,"props":1900,"children":1901},{},[1902],{"type":48,"value":1903},"xunit.*.dll",{"type":42,"tag":588,"props":1905,"children":1906},{},[1907],{"type":48,"value":1908},"Fix scan scope — exclude from shipped artifacts",{"type":42,"tag":561,"props":1910,"children":1911},{},[1912,1920,1938],{"type":42,"tag":588,"props":1913,"children":1914},{},[1915],{"type":42,"tag":64,"props":1916,"children":1917},{},[1918],{"type":48,"value":1919},"Managed C# assembly",{"type":42,"tag":588,"props":1921,"children":1922},{},[1923,1925,1930,1932],{"type":48,"value":1924},"Most ",{"type":42,"tag":169,"props":1926,"children":1928},{"className":1927},[],[1929],{"type":48,"value":1505},{"type":48,"value":1931}," from ",{"type":42,"tag":169,"props":1933,"children":1935},{"className":1934},[],[1936],{"type":48,"value":1937},".csproj",{"type":42,"tag":588,"props":1939,"children":1940},{},[1941],{"type":48,"value":1942},"BA2008 not applicable (BinSkim skips IL-only)",{"type":42,"tag":57,"props":1944,"children":1945},{},[1946],{"type":42,"tag":51,"props":1947,"children":1948},{},[1949,1955,1957,1962,1964,1969,1971,1976],{"type":42,"tag":169,"props":1950,"children":1952},{"className":1951},[],[1953],{"type":48,"value":1954},"\u003CControlFlowGuard>Guard\u003C\u002FControlFlowGuard>",{"type":48,"value":1956}," in a ",{"type":42,"tag":169,"props":1958,"children":1960},{"className":1959},[],[1961],{"type":48,"value":1937},{"type":48,"value":1963}," does ",{"type":42,"tag":64,"props":1965,"children":1966},{},[1967],{"type":48,"value":1968},"nothing",{"type":48,"value":1970},". This MSBuild property only works in ",{"type":42,"tag":169,"props":1972,"children":1974},{"className":1973},[],[1975],{"type":48,"value":1848},{"type":48,"value":1977}," (MSVC C++).",{"type":42,"tag":236,"props":1979,"children":1981},{"id":1980},"vmr-fix-ownership",[1982],{"type":48,"value":1983},"VMR fix ownership",{"type":42,"tag":51,"props":1985,"children":1986},{},[1987,1989,1995,1997,2003],{"type":48,"value":1988},"In the VMR (dotnet\u002Fdotnet), look at the SARIF artifact path to find the source sub-repo (e.g., ",{"type":42,"tag":169,"props":1990,"children":1992},{"className":1991},[],[1993],{"type":48,"value":1994},"src\u002Farcade\u002Fartifacts\u002F...",{"type":48,"value":1996}," means the fix goes to ",{"type":42,"tag":169,"props":1998,"children":2000},{"className":1999},[],[2001],{"type":48,"value":2002},"dotnet\u002Farcade",{"type":48,"value":2004},").",{"type":42,"tag":86,"props":2006,"children":2008},{"id":2007},"anti-patterns",[2009],{"type":48,"value":2010},"Anti-Patterns",{"type":42,"tag":57,"props":2012,"children":2013},{},[2014],{"type":42,"tag":51,"props":2015,"children":2016},{},[2017,2019,2025,2027,2032],{"type":48,"value":2018},"Don't scan ",{"type":42,"tag":169,"props":2020,"children":2022},{"className":2021},[],[2023],{"type":48,"value":2024},"artifacts\\bin\\",{"type":48,"value":2026}," if the pipeline uses ",{"type":42,"tag":169,"props":2028,"children":2030},{"className":2029},[],[2031],{"type":48,"value":596},{"type":48,"value":2033}," — you'll get findings from test dependencies that aren't shipped.",{"type":42,"tag":57,"props":2035,"children":2036},{},[2037],{"type":42,"tag":51,"props":2038,"children":2039},{},[2040],{"type":48,"value":2041},"Don't skip the pack step — many shippable binaries only materialize during packing.",{"type":42,"tag":57,"props":2043,"children":2044},{},[2045],{"type":42,"tag":51,"props":2046,"children":2047},{},[2048],{"type":48,"value":2049},"Don't assume the native build is required — scan NuGet-cached DLLs if native build fails locally.",{"type":42,"tag":57,"props":2051,"children":2052},{},[2053],{"type":42,"tag":51,"props":2054,"children":2055},{},[2056,2058,2064],{"type":48,"value":2057},"Don't report NuGet transitive dependency findings as repo issues — if ",{"type":42,"tag":169,"props":2059,"children":2061},{"className":2060},[],[2062],{"type":48,"value":2063},"libSkiaSharp.dll",{"type":48,"value":2065}," fails BA2008, that's SkiaSharp's issue.",{"type":42,"tag":57,"props":2067,"children":2068},{},[2069],{"type":42,"tag":51,"props":2070,"children":2071},{},[2072,2074,2079,2081,2085],{"type":48,"value":2073},"Don't be alarmed by extra local findings — use ",{"type":42,"tag":169,"props":2075,"children":2077},{"className":2076},[],[2078],{"type":48,"value":1285},{"type":48,"value":2080}," to filter to portal-reported rules. For rules reference and Guardian filtering details, see the ",{"type":42,"tag":64,"props":2082,"children":2083},{},[2084],{"type":48,"value":82},{"type":48,"value":2086}," skill.",{"type":42,"tag":86,"props":2088,"children":2090},{"id":2089},"references",[2091],{"type":48,"value":2092},"References",{"type":42,"tag":93,"props":2094,"children":2095},{},[2096,2110,2123,2140,2172],{"type":42,"tag":97,"props":2097,"children":2098},{},[2099,2104,2106],{"type":42,"tag":64,"props":2100,"children":2101},{},[2102],{"type":48,"value":2103},"Installing BinSkim",{"type":48,"value":2105},": ",{"type":42,"tag":153,"props":2107,"children":2108},{"href":155},[2109],{"type":48,"value":155},{"type":42,"tag":97,"props":2111,"children":2112},{},[2113,2118,2119],{"type":42,"tag":64,"props":2114,"children":2115},{},[2116],{"type":48,"value":2117},"Build prerequisites",{"type":48,"value":2105},{"type":42,"tag":153,"props":2120,"children":2121},{"href":198},[2122],{"type":48,"value":198},{"type":42,"tag":97,"props":2124,"children":2125},{},[2126,2131,2133,2138],{"type":42,"tag":64,"props":2127,"children":2128},{},[2129],{"type":48,"value":2130},"Per-repo pipeline configs",{"type":48,"value":2132},": Use the ",{"type":42,"tag":169,"props":2134,"children":2136},{"className":2135},[],[2137],{"type":48,"value":82},{"type":48,"value":2139}," skill for known pipeline names, SDL artifact patterns, and local repro notes per repo",{"type":42,"tag":97,"props":2141,"children":2142},{},[2143,2148,2149,2154,2156,2162,2164,2170],{"type":42,"tag":64,"props":2144,"children":2145},{},[2146],{"type":48,"value":2147},"Arcade SDL infrastructure",{"type":48,"value":2132},{"type":42,"tag":169,"props":2150,"children":2152},{"className":2151},[],[2153],{"type":48,"value":82},{"type":48,"value":2155}," skill for ",{"type":42,"tag":169,"props":2157,"children":2159},{"className":2158},[],[2160],{"type":48,"value":2161},"configure-sdl-tool.ps1",{"type":48,"value":2163}," and ",{"type":42,"tag":169,"props":2165,"children":2167},{"className":2166},[],[2168],{"type":48,"value":2169},"extract-artifact-packages.ps1",{"type":48,"value":2171}," details",{"type":42,"tag":97,"props":2173,"children":2174},{},[2175,2180,2182,2186],{"type":42,"tag":64,"props":2176,"children":2177},{},[2178],{"type":48,"value":2179},"Rules reference and Guardian filtering",{"type":48,"value":2181},": See the ",{"type":42,"tag":64,"props":2183,"children":2184},{},[2185],{"type":48,"value":82},{"type":48,"value":2187}," skill",{"type":42,"tag":2189,"props":2190,"children":2191},"style",{},[2192],{"type":48,"value":2193},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2195,"total":2360},[2196,2212,2227,2242,2260,2274,2294,2304,2316,2326,2339,2350],{"slug":2197,"name":2197,"fn":2198,"description":2199,"org":2200,"tags":2201,"stars":2209,"repoUrl":2210,"updatedAt":2211},"multithreaded-task-migration","migrate MSBuild tasks to multithreaded mode","Guide for migrating MSBuild tasks to multithreaded mode support, including compatibility red-team review. Use this when converting tasks to thread-safe versions, implementing IMultiThreadableTask, adding TaskEnvironment support, or auditing migrations for behavioral compatibility.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2202,2203,2206],{"name":17,"slug":18,"type":15},{"name":2204,"slug":2205,"type":15},"Engineering","engineering",{"name":2207,"slug":2208,"type":15},"Performance","performance",5535,"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fmsbuild","2026-07-22T05:37:33.965588",{"slug":2213,"name":2213,"fn":2214,"description":2215,"org":2216,"tags":2217,"stars":2224,"repoUrl":2225,"updatedAt":2226},"analyzing-dotnet-performance","analyze .NET code for performance anti-patterns","Scans .NET code for ~50 performance anti-patterns across async, memory, strings, collections, LINQ, regex, serialization, and I\u002FO with tiered severity classification. Use when analyzing .NET code for optimization opportunities, reviewing hot paths, or auditing allocation-heavy patterns.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2218,2219,2220,2223],{"name":17,"slug":18,"type":15},{"name":23,"slug":24,"type":15},{"name":2221,"slug":2222,"type":15},"Debugging","debugging",{"name":2207,"slug":2208,"type":15},4576,"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fskills","2026-07-12T08:23:25.400375",{"slug":2228,"name":2228,"fn":2229,"description":2230,"org":2231,"tags":2232,"stars":2224,"repoUrl":2225,"updatedAt":2241},"android-tombstone-symbolication","symbolicate .NET runtime frames in Android tombstones","Symbolicate the .NET runtime frames in an Android tombstone file. Extracts BuildIds and PC offsets from the native backtrace, downloads debug symbols from the Microsoft symbol server, and runs llvm-symbolizer to produce function names with source file and line numbers. USE FOR triaging a .NET MAUI or Mono Android app crash from a tombstone, resolving native backtrace frames in libmonosgen-2.0.so or libcoreclr.so to .NET runtime source code, or investigating SIGABRT, SIGSEGV, or other native signals originating from the .NET runtime on Android. DO NOT USE FOR pure Java\u002FKotlin crashes, managed .NET exceptions that are already captured in logcat, or iOS crash logs. INVOKES Symbolicate-Tombstone.ps1 script, llvm-symbolizer, Microsoft symbol server.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2233,2234,2237,2238],{"name":17,"slug":18,"type":15},{"name":2235,"slug":2236,"type":15},"Android","android",{"name":2221,"slug":2222,"type":15},{"name":2239,"slug":2240,"type":15},"Microsoft","microsoft","2026-07-12T08:23:21.595572",{"slug":2243,"name":2243,"fn":2244,"description":2245,"org":2246,"tags":2247,"stars":2224,"repoUrl":2225,"updatedAt":2259},"apple-crash-symbolication","symbolicate .NET runtime frames in crash logs","Symbolicate .NET runtime frames in Apple platform .ips crash logs (iOS, tvOS, Mac Catalyst, macOS). Extracts UUIDs and addresses from the native backtrace, locates dSYM debug symbols, and runs atos to produce function names with source file and line numbers. Automatically downloads .dwarf symbols from the Microsoft symbol server using Mach-O UUIDs. USE FOR triaging a .NET MAUI or Mono app crash from an .ips file on any Apple platform, resolving native backtrace frames in libcoreclr or libmonosgen-2.0 to .NET runtime source code, retrieving .ips crash logs from a connected iOS device or iPhone, or investigating EXC_CRASH, EXC_BAD_ACCESS, SIGABRT, or SIGSEGV originating from the .NET runtime. DO NOT USE FOR pure Swift\u002FObjective-C crashes with no .NET components, or Android tombstone files. INVOKES Symbolicate-Crash.ps1 script, atos, dwarfdump, idevicecrashreport.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2248,2249,2250,2253,2256],{"name":17,"slug":18,"type":15},{"name":2221,"slug":2222,"type":15},{"name":2251,"slug":2252,"type":15},"iOS","ios",{"name":2254,"slug":2255,"type":15},"macOS","macos",{"name":2257,"slug":2258,"type":15},"Observability","observability","2026-07-12T08:23:20.369986",{"slug":2261,"name":2261,"fn":2262,"description":2263,"org":2264,"tags":2265,"stars":2224,"repoUrl":2225,"updatedAt":2273},"assertion-quality","evaluate assertion quality in test suites","Analyzes the variety and depth of assertions across test suites in any language. Use when the user asks to evaluate assertion quality, find shallow tests, identify assertion-free tests (no assertions or only trivial ones like Assert.IsNotNull \u002F toBeTruthy()), flag self-referential or tautological assertions, measure assertion diversity, or audit whether tests verify different facets of behavior. Polyglot: .NET, Python, TS\u002FJS, Java, Go, Ruby, Rust, Swift, Kotlin, PowerShell, C++. DO NOT USE FOR: writing new tests (use code-testing-agent \u002F writing-mstest-tests), mutation reasoning about whether tests would catch a bug (use test-gap-analysis), or a general severity-ranked anti-pattern audit (use test-anti-patterns), fixing or rewriting assertions, or writing, fixing, or modernizing MSTest tests, assertions, or attributes (use writing-mstest-tests).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2266,2267,2270],{"name":23,"slug":24,"type":15},{"name":2268,"slug":2269,"type":15},"QA","qa",{"name":2271,"slug":2272,"type":15},"Testing","testing","2026-07-12T08:23:51.277743",{"slug":2275,"name":2275,"fn":2276,"description":2277,"org":2278,"tags":2279,"stars":2224,"repoUrl":2225,"updatedAt":2293},"author-component","create and review Blazor components","Create or review Blazor components (.razor files) with correct architecture. USE FOR: writing new Blazor components that do NOT involve JavaScript interop, implementing parameters and EventCallback, RenderFragment slots, component lifecycle (OnInitializedAsync, OnParametersSet), async patterns, IAsyncDisposable, CancellationToken, CSS isolation, code-behind. DO NOT USE FOR: creating new projects (use create-blazor-project), JavaScript interop or calling browser APIs from Blazor (use use-js-interop), forms and validation (use collect-user-input), prerendering issues (use support-prerendering), HTTP data fetching patterns (use fetch-and-send-data), coordinating state between unrelated components (use coordinate-components).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2280,2281,2284,2287,2290],{"name":17,"slug":18,"type":15},{"name":2282,"slug":2283,"type":15},"Blazor","blazor",{"name":2285,"slug":2286,"type":15},"C#","csharp",{"name":2288,"slug":2289,"type":15},"UI Components","ui-components",{"name":2291,"slug":2292,"type":15},"Web Development","web-development","2026-07-15T06:03:29.216359",{"slug":2295,"name":2295,"fn":2296,"description":2297,"org":2298,"tags":2299,"stars":2224,"repoUrl":2225,"updatedAt":2303},"binlog-failure-analysis","analyze MSBuild binary logs","Analyze MSBuild binary logs to diagnose build failures. USE FOR: build errors that are unclear from console output, diagnosing cascading failures across multi-project builds, tracing MSBuild target execution order, and generally any MSBuild build issues. Requires an existing .binlog file. DO NOT USE FOR: generating binlogs (use binlog-generation), non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2300,2301,2302],{"name":23,"slug":24,"type":15},{"name":2221,"slug":2222,"type":15},{"name":2239,"slug":2240,"type":15},"2026-07-12T08:21:34.637923",{"slug":2305,"name":2305,"fn":2306,"description":2307,"org":2308,"tags":2309,"stars":2224,"repoUrl":2225,"updatedAt":2315},"binlog-generation","generate MSBuild binary logs for diagnostics","Generate MSBuild binary logs (binlogs) for build diagnostics and analysis. USE FOR: adding \u002Fbl:{} to any dotnet build, test, pack, publish, or restore command to capture a full build execution trace, prerequisite for binlog-failure-analysis and build-perf-diagnostics skills, enabling post-build investigation of errors or performance. Requires MSBuild 17.8+ \u002F .NET 8 SDK+ for {} placeholder; PowerShell needs -bl:{{}}. DO NOT USE FOR: non-MSBuild build systems (npm, Maven, CMake), analyzing an existing binlog (use binlog-failure-analysis instead).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2310,2313,2314],{"name":2311,"slug":2312,"type":15},"Build","build",{"name":2221,"slug":2222,"type":15},{"name":2204,"slug":2205,"type":15},"2026-07-19T05:38:19.340791",{"slug":2317,"name":2317,"fn":2318,"description":2319,"org":2320,"tags":2321,"stars":2224,"repoUrl":2225,"updatedAt":2325},"build-parallelism","optimize MSBuild build parallelism","Diagnose and fix under-parallelized MSBuild builds. USE WHEN a multi-project solution build is slower than expected, doesn't speed up when you add cores, pegs a single core while others idle, or you want to know why `-m` isn't helping. Note: `\u002Fmaxcpucount` default is 1 (sequential) — always pass `-m` for parallel builds. Covers finding the critical path (longest serial ProjectReference chain), graph build (`\u002Fgraph`), BuildInParallel, and solution filters (`.slnf`). DO NOT USE FOR: single-project builds, incremental issues (use incremental-build), compilation slowness inside one project (use build-perf-diagnostics), non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2322,2323,2324],{"name":17,"slug":18,"type":15},{"name":2204,"slug":2205,"type":15},{"name":2207,"slug":2208,"type":15},"2026-07-19T05:38:18.364937",{"slug":2327,"name":2327,"fn":2328,"description":2329,"org":2330,"tags":2331,"stars":2224,"repoUrl":2225,"updatedAt":2338},"build-perf-baseline","establish and optimize build performance baselines","Establish build performance baselines and apply systematic optimization techniques. USE FOR: diagnosing slow builds, establishing before\u002Fafter measurements (cold, warm, no-op scenarios), applying optimization strategies like MSBuild Server, static graph builds, artifacts output, and dependency graph trimming. Start here before diving into build-perf-diagnostics, incremental-build, or build-parallelism. DO NOT USE FOR: non-MSBuild build systems, detailed bottleneck analysis (use build-perf-diagnostics after baselining).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2332,2333,2336,2337],{"name":2204,"slug":2205,"type":15},{"name":2334,"slug":2335,"type":15},"Monitoring","monitoring",{"name":2207,"slug":2208,"type":15},{"name":2271,"slug":2272,"type":15},"2026-07-12T08:21:35.865649",{"slug":2340,"name":2340,"fn":2341,"description":2342,"org":2343,"tags":2344,"stars":2224,"repoUrl":2225,"updatedAt":2349},"build-perf-diagnostics","diagnose MSBuild build performance bottlenecks","Diagnose MSBuild build performance bottlenecks using binary log analysis. USE FOR: identifying why builds are slow by analyzing binlog performance summaries, detecting ResolveAssemblyReference (RAR) taking >5s, Roslyn analyzers consuming >30% of Csc time, single targets dominating >50% of build time, node utilization below 80%, excessive Copy tasks, NuGet restore running every build. Covers timeline analysis, Target\u002FTask Performance Summary interpretation, and 7 common bottleneck categories. Use after build-perf-baseline has established measurements. DO NOT USE FOR: establishing initial baselines (use build-perf-baseline first), fixing incremental build issues (use incremental-build), parallelism tuning (use build-parallelism), non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2345,2346,2347,2348],{"name":17,"slug":18,"type":15},{"name":2221,"slug":2222,"type":15},{"name":2204,"slug":2205,"type":15},{"name":2207,"slug":2208,"type":15},"2026-07-12T08:21:40.961722",{"slug":2351,"name":2351,"fn":2352,"description":2353,"org":2354,"tags":2355,"stars":2224,"repoUrl":2225,"updatedAt":2359},"check-bin-obj-clash","detect MSBuild output path conflicts","Detects MSBuild projects with conflicting OutputPath or IntermediateOutputPath. USE FOR: builds failing with 'Cannot create a file when that file already exists', 'The process cannot access the file because it is being used by another process', intermittent build failures that succeed on retry, or missing\u002Foverwritten outputs in multi-project or multi-targeting builds where bin\u002Fobj (or project.assets.json) collide. Common causes: shared OutputPath, missing AppendTargetFrameworkToOutputPath, extra global properties (e.g. PublishReadyToRun), or SetTargetFramework on a ProjectReference to a single-targeting project. DO NOT USE FOR: file access errors unrelated to MSBuild (OS-level locking), single-project single-TFM builds, non-MSBuild build systems.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2356,2357,2358],{"name":2221,"slug":2222,"type":15},{"name":2204,"slug":2205,"type":15},{"name":2268,"slug":2269,"type":15},"2026-07-19T05:38:14.336279",144,{"items":2362,"total":25},[2363,2375,2382,2397,2408,2423,2433],{"slug":82,"name":82,"fn":2364,"description":2365,"org":2366,"tags":2367,"stars":25,"repoUrl":26,"updatedAt":2374},"investigate BinSkim SDL security findings","Investigate BinSkim SDL findings from official pipelines — understand Guardian filtering, compare raw vs merged SARIF, decode portal results, and determine fix ownership. Use when asked about SDL scan results, portal findings, Guardian filtering, rule meanings, or discrepancies between local and official results. Also use when asked \"why does the portal show X\", \"what's filtered\", \"explain Guardian\", \"investigate SDL findings\", \"portal BA2008\", \"binskim failures in pipeline\", or \"what rules are required\". DO NOT USE FOR: running BinSkim locally (use binskim-scan), source code analysis (use CodeQL), or credential scanning (use CredScan).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2368,2369,2372,2373],{"name":17,"slug":18,"type":15},{"name":2370,"slug":2371,"type":15},"Audit","audit",{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T08:23:11.212231",{"slug":4,"name":4,"fn":5,"description":6,"org":2376,"tags":2377,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2378,2379,2380,2381],{"name":17,"slug":18,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":2383,"name":2383,"fn":2384,"description":2385,"org":2386,"tags":2387,"stars":25,"repoUrl":26,"updatedAt":2396},"ci-analysis","analyze .NET CI build and test status","Analyze CI build and test status from Azure DevOps and Helix for dotnet repository PRs. Use when checking CI status, investigating failures, determining if a PR is ready to merge, or given URLs containing dev.azure.com or helix.dot.net. Also use when asked \"why is CI red\", \"test failures\", \"retry CI\", \"rerun tests\", \"is CI green\", \"build failed\", \"checks failing\", or \"flaky tests\". DO NOT USE FOR: investigating stale codeflow PRs or dependency update health, tracing whether a commit has flowed from one repo to another, reviewing code changes for correctness or style.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2388,2389,2392,2395],{"name":17,"slug":18,"type":15},{"name":2390,"slug":2391,"type":15},"Azure","azure",{"name":2393,"slug":2394,"type":15},"CI\u002FCD","ci-cd",{"name":2221,"slug":2222,"type":15},"2026-07-12T08:21:49.360882",{"slug":2398,"name":2398,"fn":2399,"description":2400,"org":2401,"tags":2402,"stars":25,"repoUrl":26,"updatedAt":2407},"ci-crash-dump","debug CI crash dumps","Download and debug crash dumps from CI test failures in dotnet repositories. Use when a CI test crashed (not just failed), when the user wants to debug a crash dump from a PR or build, or when asked \"debug dump\", \"download dump\", \"crash dump from CI\", \"test crashed\", \"analyze crash in PR\", or \"why did the test crash\". DO NOT USE FOR: test failures that are not crashes (use ci-analysis), build failures, performance analysis, or analyzing dumps you already have locally.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2403,2404,2405,2406],{"name":17,"slug":18,"type":15},{"name":2393,"slug":2394,"type":15},{"name":2221,"slug":2222,"type":15},{"name":2271,"slug":2272,"type":15},"2026-07-12T08:21:56.945844",{"slug":2409,"name":2409,"fn":2410,"description":2411,"org":2412,"tags":2413,"stars":25,"repoUrl":26,"updatedAt":2422},"flow-analysis","analyze VMR codeflow health","Analyze VMR codeflow health using maestro MCP tools and GitHub MCP tools. USE FOR: investigating stale codeflow PRs, checking if fixes have flowed through the VMR pipeline, debugging dependency update issues, checking overall flow status for a repo, diagnosing why backflow PRs are missing or blocked, subscription health, build freshness, URLs containing dotnet-maestro or \"Source code updates from dotnet\u002Fdotnet\". DO NOT USE FOR: CI build failures (use ci-analysis skill), code review (use code-review skill), general PR investigation without codeflow context, tracing whether a specific commit\u002FPR has reached another repo (use flow-tracing skill). INVOKES: maestro and GitHub MCP tools, flow-health.cs script.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2414,2415,2416,2419],{"name":2393,"slug":2394,"type":15},{"name":2204,"slug":2205,"type":15},{"name":2417,"slug":2418,"type":15},"GitHub","github",{"name":2420,"slug":2421,"type":15},"MCP","mcp","2026-07-12T08:21:53.151866",{"slug":2424,"name":2424,"fn":2425,"description":2426,"org":2427,"tags":2428,"stars":25,"repoUrl":26,"updatedAt":2432},"flow-tracing","trace .NET dependency flow in VMR","Trace dependency flow across .NET repos through the VMR pipeline. USE FOR: checking if a PR\u002Fcommit from repo A has reached repo B, finding what runtime SHA is in an SDK build, tracing dependency versions through the VMR, checking if a commit is included in an SDK build, decoding SDK version strings, \"has my fix reached runtime\", \"did roslyn#80873 flow to runtime\", \"what SHA is in SDK version X\", cross-repo dependency tracing, mapping SDK versions to VMR commits. DO NOT USE FOR: codeflow PR health or staleness (use flow-analysis skill), CI build failures (use ci-analysis skill). INVOKES: maestro and GitHub MCP tools, Get-SdkVersionTrace.ps1 script.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2429],{"name":2430,"slug":2431,"type":15},"Data Pipeline","data-pipeline","2026-07-12T08:21:55.689056",{"slug":2434,"name":2434,"fn":2435,"description":2436,"org":2437,"tags":2438,"stars":25,"repoUrl":26,"updatedAt":2442},"helix-investigation","investigate Helix test failures","Deep-dive investigation of Helix test failures starting from AzDO build legs. USE FOR: investigating recurring Helix test failures, downloading and analyzing Helix console logs, comparing passing vs failing runs, identifying machine-specific issues, XHarness timeout analysis, Android emulator DEVICE_NOT_FOUND errors, bulk failure aggregation across legs, \"why does this test fail on some machines\", \"top 5 failing tests in the last 2 days\", \"download helix logs for build X\", \"compare passing and failing helix runs\", \"what are the most common failures\". DO NOT USE FOR: high-level CI status checks (use ci-analysis), codeflow PRs (use flow-analysis). INVOKES: Helix and AzDO MCP tools, curl, gh CLI.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2439,2440,2441],{"name":2221,"slug":2222,"type":15},{"name":2204,"slug":2205,"type":15},{"name":2271,"slug":2272,"type":15},"2026-07-12T08:21:46.445586"]