azdo-build-investigator

Pass

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: SAFE
Full Analysis
  • [Integration with External Build Tools]: The skill is designed to extend the functionality of the ci-analysis skill from the dotnet/arcade-skills repository. This integration provides project-specific metadata, such as pipeline IDs, to assist in automated build investigations.
  • [Secure Authentication Patterns]: To facilitate the download of build logs, the skill instructs on using az account get-access-token to obtain a temporary Bearer token. This approach follows security best practices by avoiding hardcoded credentials and leveraging identity-based access.
  • [Infrastructure API Interaction]: The skill references the Helix API (helix.dot.net) for retrieving aggregated test results. This is the official telemetry system used for .NET cross-platform testing, and its use is appropriate for the skill's stated purpose of CI investigation.
  • [Development Workflow Commands]: It suggests the use of local repository scripts, such as ./eng/ingest-maven-deps.sh, to address specific dependency resolution issues. These commands are part of the standard maintenance workflow for the project.
Audit Metadata
Risk Level
SAFE
Analyzed
May 16, 2026, 02:32 AM
Security Audit — agent-trust-hub — azdo-build-investigator