saury-revit
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses user-supplied strings for project naming and output directories which are then directly interpolated into command-line templates.
- Ingestion points: User-provided Project Name and Output Directory in
SKILL.md. - Boundary markers: The skill lacks explicit sanitization or delimiters to prevent user-supplied strings from being interpreted as command arguments or chained commands.
- Capability inventory: The skill uses the
dotnetCLI andpowershellfor template management, project creation, and build operations. - Sanitization: Relies on user confirmation of the汇总 configuration and manual adherence to naming rules rather than automated escaping or validation.
- [EXTERNAL_DOWNLOADS]: Downloads the official .NET installation script from Microsoft's well-known
dot.netdomain. - [REMOTE_CODE_EXECUTION]: Executes the official .NET installation PowerShell script downloaded from Microsoft to configure the development environment.
- [COMMAND_EXECUTION]: Utilizes the
dotnetCLI to perform project lifecycle operations, including installing templates and building binaries that are deployed to the system'sC:\ProgramData\directory.
Audit Metadata