dotnet-trace-collect

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading diagnostic tools from official Microsoft sources, including aka.ms and github.com/microsoft. These downloads are from a well-known service and are standard for .NET development workflows.
  • [COMMAND_EXECUTION]: The workflow involves generating and executing diagnostic commands like dotnet-trace collect, PerfView collect, and kubectl port-forward. These operations are limited to the intended scope of performance monitoring and data collection.
  • [PRIVILEGE_ESCALATION]: To capture kernel events and machine-wide traces, the skill recommends using sudo, root access, or privileged container modes (--privileged, SYS_ADMIN). These elevated permissions are documented requirements for the underlying technologies (LTTng, perf_events, ETW) used by the diagnostic tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill gathers environmental context (OS, runtime, symptoms) from user input to determine the correct diagnostic path. The ingestion point is identified in SKILL.md (Step 1), and while the input is interpolated into guidance, the risk is minimal as it guides the selection of predefined command templates rather than executing arbitrary user-provided code.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 05:11 AM