migrate-dotnet9-to-dotnet10
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to analyze and modify user project files, which creates a potential surface for indirect prompt injection if those files contain instructions targeting the AI agent.\n
- Ingestion points: The workflow in
SKILL.md(Steps 1, 2, and 3) involves reading and analyzing data from.csproj,.sln,.slnx,Dockerfile, and C# source files.\n - Boundary markers: The instructions do not currently include explicit boundary markers or "ignore instructions" directives when processing these external files.\n
- Capability inventory: The skill utilizes shell command execution via the
dotnetCLI (build,restore,test) and performs filesystem write operations to update project configurations.\n - Sanitization: There are no explicit sanitization or validation steps mentioned for the content read from user-provided project files.\n- Security-Conscious Migration Guidance: The provided reference materials, particularly
references/cryptography-dotnet9to10.mdandreferences/serialization-networking-dotnet9to10.md, include helpful security considerations. They remind users to preserve TLS cipher validation logic and audit obsolete properties for potential sensitive data exposure during the migration.
Audit Metadata