skills/dotnet/efcore/run-apichief/Gen Agent Trust Hub

run-apichief

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • Command Execution: The skill invokes repository-specific scripts such as restore.cmd, activate.ps1, and build.cmd, along with standard .NET build commands. These operations are expected for a tool designed to perform API baseline management and validation within a specific project environment.
  • Indirect Prompt Injection Surface: The skill identifies project folders and extracts metadata (like AssemblyName and TargetPath) from local .csproj files to construct its commands. While this is a standard automation pattern, it defines a surface where the contents of the local repository influence the execution parameters of the agent.
  • Ingestion points: The skill scans the src/ directory and executes msbuild to retrieve project properties from SKILL.md instructions.
  • Boundary markers: No explicit delimiters are used for the discovered file paths or properties.
  • Capability inventory: The skill uses dotnet build, msbuild, and script execution to process the repository.
  • Sanitization: The skill applies .Trim() to command outputs before using them as variables in subsequent shell executions.
  • Dynamic Path Execution: The skill dynamically calculates paths for target assemblies and the ApiChief binary at runtime using file system discovery and build system queries. This allows the skill to correctly target the appropriate build artifacts (e.g., specific TFMs) without hardcoded paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 09:20 PM