dotnet-slopwatch
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the 'Slopwatch.Cmd' tool from the public NuGet package registry.
- Evidence: Provides configuration for
.config/dotnet-tools.jsonand instructions for global installation viadotnet tool install --global Slopwatch.Cmd. - [COMMAND_EXECUTION]: The skill recommends setting up automated shell command hooks within the agent's environment.
- Evidence: Instructs the user to add a
PostToolUsehook to.claude/settings.jsonthat executesslopwatch analyze -d . --hookafter file modifications. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code and returns analysis output to the agent, creating a surface where embedded instructions could influence behavior.
- Ingestion points: Reads local C# source files (
.cs), project files (.csproj), and build configuration files (.props). - Boundary markers: Absent; tool output is not explicitly delimited to prevent command leakage from analyzed code snippets.
- Capability inventory: The skill is used in a context where the agent has file-write and shell-execution permissions to perform and verify code edits.
- Sanitization: No explicit sanitization or escaping of the analyzed source code content is documented for the tool's output.
Audit Metadata