container-publish
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard technical documentation and code snippets for .NET containerization workflows.
- [COMMAND_EXECUTION]: The skill includes legitimate build and deployment commands (
dotnet publish,docker login,az acr login). These are standard developer tools and are used appropriately for the stated purpose. - [EXTERNAL_DOWNLOADS]: The skill references official GitHub Actions (
actions/checkout,actions/setup-dotnet,docker/login-action) and well-known container registries (GitHub Container Registry, Docker Hub, Azure Container Registry). These are trusted and well-known services. - [DATA_EXFILTRATION]: While the skill involves pushing container images to external registries, this is the primary intended function of the skill. It uses standard, authenticated protocols and encourages the use of secrets in CI/CD pipelines rather than hardcoding credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with local project files (
.csproj). While this presents a theoretical attack surface where a project file could contain malicious instructions for an agent, the skill does not exhibit any patterns that would exploit this, and the capability is essential for its function.
Audit Metadata