stylecop-analyzers

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard .NET development commands (dotnet add, dotnet build) and search tools (rg) to manage linter installation and verify project state. These operations are restricted to the local repository context and represent routine development tasks.\n- [EXTERNAL_DOWNLOADS]: The skill fetches the StyleCop.Analyzers package from the standard NuGet registry and references JSON schemas from the official DotNetAnalyzers GitHub repository. These are well-known and trusted sources in the .NET ecosystem.\n- [DYNAMIC_EXECUTION]: A one-line Python command is provided to validate the syntax of stylecop.json files. This is a common method for ensuring configuration files are well-formed before use.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository's configuration files, which could serve as a vector for indirect prompt injection.\n
  • Ingestion points: The skill reads .editorconfig, stylecop.json, and AGENTS.md from the repository root to determine style rules and constraints.\n
  • Boundary markers: No explicit instructions are provided to the agent to distinguish between configuration data and potential natural language instructions embedded within these files.\n
  • Capability inventory: The skill possesses the capability to modify repository files and execute dotnet build and package management commands.\n
  • Sanitization: The skill performs JSON syntax validation but does not sanitize the logical content of the configuration files for potential injection patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 08:58 AM