stylecop-analyzers
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard .NET development commands (
dotnet add,dotnet build) and search tools (rg) to manage linter installation and verify project state. These operations are restricted to the local repository context and represent routine development tasks.\n- [EXTERNAL_DOWNLOADS]: The skill fetches theStyleCop.Analyzerspackage from the standard NuGet registry and references JSON schemas from the official DotNetAnalyzers GitHub repository. These are well-known and trusted sources in the .NET ecosystem.\n- [DYNAMIC_EXECUTION]: A one-line Python command is provided to validate the syntax ofstylecop.jsonfiles. This is a common method for ensuring configuration files are well-formed before use.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository's configuration files, which could serve as a vector for indirect prompt injection.\n - Ingestion points: The skill reads
.editorconfig,stylecop.json, andAGENTS.mdfrom the repository root to determine style rules and constraints.\n - Boundary markers: No explicit instructions are provided to the agent to distinguish between configuration data and potential natural language instructions embedded within these files.\n
- Capability inventory: The skill possesses the capability to modify repository files and execute
dotnetbuild and package management commands.\n - Sanitization: The skill performs JSON syntax validation but does not sanitize the logical content of the configuration files for potential injection patterns.
Audit Metadata