csharp-dotnet
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from the local environment, including C# source code (.cs, .razor), project definitions (.csproj, .props, .targets), and MSBuild binary logs (.binlog).
- Ingestion points: The skill instructions command the agent to read and analyze source code and build artifacts in the
review,fix-build, anddiagnose-runtime-issueworkflows. - Boundary markers: The instructions lack specific guidance for the agent to ignore or delimit potentially malicious instructions embedded in code comments, string literals, or build metadata.
- Capability inventory: The skill utilizes powerful CLI tools including
dotnet build,dotnet restore,dotnet msbuild, anddotnet tool install, and is instructed to modify project files directly. - Sanitization: No explicit sanitization or validation of the input files (code, logs) is described in the workflows.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install official .NET diagnostic tools (
dotnet-counters,dotnet-trace,dotnet-dump) globally. These are well-known tools provided by Microsoft and distributed via the official NuGet registry. - [COMMAND_EXECUTION]: The skill makes extensive use of the .NET CLI and MSBuild for project analysis and diagnostics. These commands (e.g.,
dotnet msbuild -pp,dotnet restore,dotnet build -bl) are standard for the skill's stated purpose of assisting with .NET development and troubleshooting.
Audit Metadata