migrate-static-to-wrapper
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Processing Untrusted Data]: The skill identifies and modifies source code files within the user's workspace (e.g., discovery of
.csfiles in Step 1). While necessary for the migration task, this represents an indirect prompt injection surface where instructions hidden in code comments or string literals could theoretically influence the agent. The skill manages this risk by defining "mechanical, codemod-style" boundaries and requiring verification of the exact member set before editing. - [Command Execution]: The skill utilizes host-native shell readers and editors (
sed,cat,Get-Content) as fallbacks for file operations and uses the .NET CLI (dotnet build,dotnet test) for validation. These commands are localized to the workspace and are standard tools for C# development environments. - [Dynamic Code Generation]: The workflow involves generating C# code patterns, such as the "ambient seam" template for static classes in Step 3. This script generation is template-based and intended to provide a specific architectural solution for testability.
- [External Package References]: The skill recommends well-known libraries like
System.IO.AbstractionsandMicrosoft.Bcl.TimeProviderto replace static dependencies. These are standard industry packages, and the skill correctly requires explicit user authorization before adding new dependencies to a project.
Audit Metadata