dotnet-benchmark
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using
pwshand thedotnetCLI to perform repository inspection, project building, and benchmark execution.\n - Evidence:
SKILL.mdspecifies commands such aspwsh -NoProfile -File "<skill-root>/scripts/check-benchmark-requirements.ps1"anddotnet run -c Release ....\n- [DYNAMIC_EXECUTION]: Bundled PowerShell scripts are used for repository state detection. These scripts invoke thedotnetCLI as a subprocess to verify environment details.\n - Evidence: The script
scripts/check-benchmark-requirements.ps1uses[System.Diagnostics.Process]to executedotnet --versionand capture its output.\n- [INDIRECT_PROMPT_INJECTION]: The skill analyzes repository source code and project metadata to design benchmark experiments. Malicious instructions placed in repository content (e.g., in source code comments) could potentially influence the agent's behavior during its analysis or code generation phases.\n - Ingestion points: The agent reads source implementation, call sites, tests, and project files (
SKILL.md, Step 3).\n - Capability inventory: The agent can create/modify C# and project files and execute CLI tools.\n
- Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from acting on instructions found within repository content.\n
- Sanitization: No content sanitization or filtering mechanisms are specified for the ingested repository data.
Audit Metadata