Build or maintain controller-based ASP.NET Core APIs when the project needs controller conventions, advanced model binding, validation extensions, OData, JsonPatch, or existing API patterns. USE FOR: working on controller-based APIs in ASP.NET Core; needing controller-specific extensibility or conventions; migrating or reviewing existing API controllers and filters. DO NOT USE FOR: unrelated stacks; generic tasks that do not need this specific guidance. INVOKES: inspect the repository context, e
SkillScore91Maintained
Automatic
◆Coding pack
Last verified 8/19/2026
What it changes
Passed 20 of 22 test cases with the skill, and 16 of 22 without it.
Without skill73%
With skill91%
Checks it passed that the model alone missed
The DTO avoids positional record constructor syntax.
Options for ApiBehaviorOptions are configured via Configure<ApiBehaviorOptions>.
The DTO is defined as a record type with init-only properties marked with the required modifier.
and 5 more in the full report
5 fixed15 passed either way1 still failing1 broke
Pass-rate lift
+18 pp
Tokens
+54%
Agent turns
0%
Response time
-31%
Model gemini-3.6-flashMeasured 8/19/2026v220 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
I have a monolithic CustomersController in ASP.NET Core that contains direct database access and thick business logic. Can you help me refactor it into a clean, thin controller? Please output the refactored controller code alongside a sample request record DTO, including dependency injection, explicit parameter bindings, HTTP status code attributes, and asynchronous cancellation support.
What was checked, without and with the skill
Checked
Without skill
With skill
The controller uses C# 12 primary constructor syntax for dependency injection instead of an explicit constructor body.
Missed
Passed
The request DTO uses init-only properties with the required modifier instead of positional record parameters.
Missed
Passed
Action methods accept CancellationToken as a parameter and pass it to underlying service calls.
Passed
Passed
case-01 · gemini-3.6-flash · 8/19/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md227 lines3 files
ASP.NET Core Web API
Trigger On
working on controller-based APIs in ASP.NET Core
needing controller-specific extensibility or conventions
migrating or reviewing existing API controllers and filters
Workflow
Use controllers when the API needs controller-centric features, not simply because older templates did so.
Keep controllers thin: map HTTP concerns to application services or handlers, and avoid embedding data access and business rules directly in actions.
Use clear DTO boundaries, explicit validation, and predictable HTTP status behavior.
Review authentication and authorization at both controller and endpoint levels so the API surface is not accidentally inconsistent.
Keep OpenAPI generation, versioning, and error contract behavior deliberate rather than incidental.
Use minimal-apis for new simple APIs instead of defaulting to controllers out of habit.
Current Upstream Notes
dotnet/aspnetcorev10.0.11 is servicing and updates the OpenAPI stack to 2.7.5; controller-based API guidance still depends on conventions, advanced model binding, OData, JsonPatch, and existing filters. Re-run generated-document and client contract checks after upgrading.
The August 2026 aspnetcore-10.0 overview keeps controller APIs alongside Minimal APIs rather than replacing them. Use the dedicated routing, OpenAPI, auth, and hosting pages before changing public API contracts.
Deliver
controller APIs with explicit contracts and policies
reduced controller bloat
tests or smoke checks for critical API behavior
Validate
controller features are actually justified
actions do not hide business logic and persistence details
HTTP semantics stay predictable across endpoints
Controller Structure
Use primary constructors (C# 12+) for dependency injection and keep controllers focused on HTTP concerns: