cli-channel-debugging
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- External Data Retrieval: The skill fetches Aspire package version metadata from official Microsoft and NuGet package registries (e.g.,
api.nuget.organdpkgs.dev.azure.com). These are established, trusted services used for package management. - Command Execution: The skill performs standard development operations such as building the CLI project using
dotnet buildand executing the resulting binaries. These actions are limited to the local repository environment. - Indirect Prompt Injection Surface: The skill processes version information retrieved from external feeds to configure environment variables. While this introduces a theoretical injection surface for untrusted data, the risk is minimized by the use of structured data from trusted sources and the specialized nature of the debugging tool.
- Dynamic Execution Patterns: The provided scripts use
evalto define shell functions and execute embedded Python logic for parsing version strings. These patterns are used here to facilitate environment setup and version comparison within the local development context.
Audit Metadata