skills/team/nuget-package-scaffold/SKILL.md
NuGet package creation with CI/CD pipeline setup and test harness. Use when creating new NuGet packages, configuring package metadata, or setting up publish workflows. Do NOT use when the library is internal-only and not intended for NuGet publication; Do NOT use when the target is an application project.
npx skillsauth add michaelalber/ai-toolkit nuget-package-scaffoldInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"The best libraries are those that disappear into the code that uses them." -- Krzysztof Cwalina, Framework Design Guidelines
This skill scaffolds production-ready NuGet packages with proper metadata, testing, CI/CD pipelines, and publish workflows. Every package must meet a quality bar before it reaches any feed.
Non-negotiable constraints:
The full domain principles, knowledge-base lookup protocol, AI discipline rules, anti-patterns, and error-recovery procedures live in references/conventions.md.
Six-step pipeline: Scaffold → Configure → Test → Pack → Publish (with iterate back if needed).
Create the solution structure:
PackageName/
├── src/
│ └── PackageName/
│ ├── PackageName.csproj
│ └── Class1.cs
├── tests/
│ └── PackageName.Tests/
│ ├── PackageName.Tests.csproj
│ └── Class1Tests.cs
├── .github/
│ └── workflows/
│ ├── ci.yml
│ └── publish.yml
├── PackageName.sln
├── Directory.Build.props
├── README.md
├── LICENSE
└── .editorconfig
Required metadata properties checklist:
PackageId -- unique identifier on the feedVersion -- SemVer-compliant version stringAuthors -- comma-separated author namesDescription -- concise summary of what the package doesPackageLicenseExpression -- SPDX license identifier (e.g., MIT, Apache-2.0)PackageProjectUrl -- link to the project repositoryRepositoryUrl -- source repository URLRepositoryType -- typically gitPackageReadmeFile -- path to the README to embed in the packagePackageTags -- space-separated discovery tagsTargetFrameworks -- semicolon-separated TFMsMulti-target decision: TargetFrameworks: netstandard2.0;net10.0 when pre-.NET 10 consumers need support; TargetFrameworks: net10.0 otherwise. Full property reference: references/csproj-metadata.md.
dotnet test --configuration Release
Verify all unit tests pass on every target framework, public API surface is tested, edge cases and error paths are covered.
dotnet pack --configuration Release --output ./artifacts
dotnet nuget verify ./artifacts/PackageName.1.0.0.nupkg
unzip -l ./artifacts/PackageName.1.0.0.nupkg
# To nuget.org
dotnet nuget push ./artifacts/PackageName.1.0.0.nupkg \
--api-key $NUGET_API_KEY \
--source https://api.nuget.org/v3/index.json
# To a private feed
dotnet nuget push ./artifacts/PackageName.1.0.0.nupkg \
--api-key $FEED_API_KEY \
--source https://pkgs.dev.azure.com/org/project/_packaging/feed/nuget/v3/index.json
<nuget-scaffold-state>
step: [scaffold | configure | test | pack | publish]
package_name: [name]
target_frameworks: [frameworks]
version: [version]
publish_target: [nuget.org | private feed | local]
last_action: [what was done]
next_action: [what's next]
blockers: [issues]
</nuget-scaffold-state>
| Template | Required Content | |----------|-----------------| | Project Scaffold | Created files table (path → purpose), initial state block | | .csproj Configuration | Configured properties list (PackageId, Version, Authors, etc.), Build settings (Deterministic, Source Link, Nullable), state block | | CI/CD Pipeline Setup | Pipeline stages table (Stage / Trigger / Actions: Build=Push/PR, Pack=Tag push, Publish=Tag+approval), state block |
Full templates: references/cicd-templates.md.
AI discipline rules (never publish without tests, validate metadata, multi-target verification, API-surface review), the anti-pattern catalog, and step-by-step error recovery all live in references/conventions.md.
dotnet-vertical-slice -- use to structure the internal architecture, then use this skill to wrap it as a distributable NuGet packagetdd, tdd-agent) -- develop the package internals using TDD workflows before progressing to the Pack step; the test project created by this scaffold integrates directly with TDD phase managementmcp-server-scaffold (in the edge-ai-robotics-automation-toolkit supplement) -- when building an MCP server that ships as a dotnet tool NuGet package, use this skill for the packaging and mcp-server-scaffold for the server implementationdevelopment
Interviews the user relentlessly about a plan, decision, or idea — one question at a time, each with a recommended answer. Shared engine behind "grill-me" and "grill-with-docs". Use on any "grill" trigger phrase or to stress-test thinking. Do NOT use to build the plan; it ends at shared understanding, not implementation.
testing
Runs a relentless interview to sharpen a plan or design, capturing the decisions as ADRs and a glossary along the way. Use when the user wants to be grilled AND wants the session to leave durable domain documentation behind. Do NOT use for a throwaway stress-test with no artifacts; use grill-me instead.
tools
OWASP-based security review of Vue/TypeScript front-ends. Detects framework (Vite/Vue CLI/Nuxt), entry points, and data flows; scans the OWASP Top 10 (2025) mapped to Vue client-side risks (raw-HTML XSS via v-html, URL/protocol injection, bundled secrets, insecure token storage, dependency CVEs, missing CSP, open redirects, router guard bypass); emits an exec summary plus graded findings. Use to audit Vue for vulnerabilities. Not for architecture grading (vue-architecture-checklist).
tools
Analyzes legacy Vue codebases and produces actionable modernization plans. Primary migration paths include Options API to Composition API, Vue 2 to Vue 3, Vue CLI to Vite, JavaScript to TypeScript, Vue Test Utils/Karma/Mocha to Vitest + Vue Testing Library, legacy Vuex to Pinia, and removed-in-Vue-3 pattern cleanup (filters, event bus, `$listeners`). Does NOT perform the migration — assesses, quantifies risk, and plans.