dotnet-strong-name-signing
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes PowerShell commands (pwsh) to perform cryptographic operations and manage files. Evidence: SKILL.md contains two PowerShell blocks in Step 2 and Step 3 for generating and verifying the .snk file.
- [DYNAMIC_EXECUTION]: The skill constructs PowerShell scripts at runtime by interpolating variables like {KEY_SIZE} and {OUTPUT_PATH} into command templates. Evidence: Step 2 of SKILL.md shows a template script where parameters are dynamically replaced before execution.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user (filenames and paths) and the local environment (Git repository metadata) which is then used in shell commands. Ingestion points: key_name, output_dir (from FORMS.md), and the output of git rev-parse in SKILL.md. Boundary markers: A mandatory confirmation gate is enforced where the user must approve a summary of all parameters before the operation proceeds. Capability inventory: The skill can write files to the disk and execute arbitrary PowerShell code through the pwsh tool. Sanitization: While the skill documentation defines a strict workflow, it does not specify character escaping for the interpolated values, representing a potential injection surface if the platform does not sanitize inputs.
Audit Metadata