ln-822-nuget-upgrader
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
dotnet-outdated-toolglobally from the official NuGet package registry to assist with dependency detection. - [EXTERNAL_DOWNLOADS]: It includes a fallback mechanism to fetch missing reference documentation or shared configuration files from the author's GitHub repository at
github.com/levnikolaevich/claude-code-skillsusing the WebFetch tool. - [COMMAND_EXECUTION]: The instructions direct the agent to execute various .NET CLI operations, including
dotnet list,dotnet add package,dotnet restore,dotnet build, anddotnet test. These are standard actions for the intended purpose of managing software dependencies. - [COMMAND_EXECUTION]: For long-running operations (expected >30s), the skill suggests using a background execution or monitoring utility to manage the lifecycle of the build and test processes.
- [PROMPT_INJECTION]: The skill processes external project files (
.csproj,.sln) as untrusted data during the upgrade workflow. While these files are consumed by standard build tools, they represent a surface for indirect prompt injection if the files contain malicious metadata or instructions intended to influence the agent's behavior during the analysis phase.
Audit Metadata