microsoft-extensions-ai
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: A comprehensive analysis of the documentation and included code samples revealed no malicious patterns, data exfiltration, or obfuscation. The skill appropriately recommends secure development practices, such as using Managed Identities (Microsoft Entra ID) for authentication and local secret storage (dotnet user-secrets) for managing API keys during development.
- [COMMAND_EXECUTION]: The documentation contains numerous CLI examples for environment setup and package management (e.g.,
dotnet add package,dotnet new install,dotnet user-secrets). These are standard developer operations and are presented as illustrative examples for manual execution. - [EXTERNAL_DOWNLOADS]: The skill references official .NET and Azure NuGet packages (e.g.,
Microsoft.Extensions.AI,Azure.AI.OpenAI) and tools from established repositories (e.g., the Model Context Protocol C# SDK). These originate from trusted organizations and well-known services. - [INDIRECT_PROMPT_INJECTION]: The documentation describes the construction of data ingestion and Retrieval-Augmented Generation (RAG) pipelines, which inherently process external and potentially untrusted content. However, the skill provides extensive guidance on mitigating these risks by implementing quality, NLP, and safety evaluation gates using the
Microsoft.Extensions.AI.Evaluationlibraries.
Audit Metadata