dotnet-slopwatch

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'Slopwatch.Cmd' tool from the public NuGet package registry.
  • Evidence: Provides configuration for .config/dotnet-tools.json and instructions for global installation via dotnet tool install --global Slopwatch.Cmd.
  • [COMMAND_EXECUTION]: The skill recommends setting up automated shell command hooks within the agent's environment.
  • Evidence: Instructs the user to add a PostToolUse hook to .claude/settings.json that executes slopwatch analyze -d . --hook after file modifications.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code and returns analysis output to the agent, creating a surface where embedded instructions could influence behavior.
  • Ingestion points: Reads local C# source files (.cs), project files (.csproj), and build configuration files (.props).
  • Boundary markers: Absent; tool output is not explicitly delimited to prevent command leakage from analyzed code snippets.
  • Capability inventory: The skill is used in a context where the agent has file-write and shell-execution permissions to perform and verify code edits.
  • Sanitization: No explicit sanitization or escaping of the analyzed source code content is documented for the tool's output.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 10:27 PM