migrate-dotnet8-to-dotnet9
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a professional migration tool that follows security best practices. It includes proactive warnings against common security pitfalls, such as the use of the inherently unsafe BinaryFormatter, the risk of credential leaks in unredacted HttpClient logs, and the importance of maintaining security analyzers like WFO1000.
- [COMMAND_EXECUTION]: The skill instructs the agent to perform standard .NET development tasks using the 'dotnet' CLI, including building, testing, and restoring projects. These operations are appropriate for the skill's stated purpose of framework migration.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes untrusted project and solution files to determine migration steps and verify build status.
- Ingestion points: The skill reads configuration data from files such as .csproj, .sln, .slnx, Directory.Build.props, Directory.Packages.props, Dockerfile, and global.json.
- Boundary markers: The instructions contain explicit directives to the agent to rely only on the provided reference documents for authoritative migration information.
- Capability inventory: The skill utilizes shell execution for project build and test commands, which can potentially be manipulated by malicious content within project files (e.g., custom MSBuild targets).
- Sanitization: No specific validation or sanitization is mentioned for the content of the project files before they are processed by the CLI tools.
Audit Metadata