quality-ci
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various .NET CLI commands such as
dotnet build,dotnet test,dotnet format, anddotnet restore. These operations are essential for its stated purpose of configuring and verifying CI quality gates. - [EXTERNAL_DOWNLOADS]: The skill recommends installing several third-party .NET analyzers, coverage tools, and security scanners (e.g.,
StyleCopAnalyzers,Stryker.NET,ReportGenerator,ReSharper CLT) via NuGet ordotnet tool install. These are well-established tools in the .NET ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection surface because it reads and processes repository files (
.csproj,.editorconfig, CI workflows) which could contain malicious instructions designed to influence the agent's behavior during the setup or validation process. - Ingestion points: Processes
AGENTS.md,.editorconfig, MSBuild props, CI workflows, and project files. - Boundary markers: None explicitly mentioned to separate untrusted file content from instructions.
- Capability inventory: Capable of writing to project files, updating CI workflows, and executing shell commands through the .NET CLI.
- Sanitization: No explicit sanitization of repository content is described before processing.
Audit Metadata