azure-eventgrid-dotnet
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- External Package Installation: The skill references several official .NET packages (e.g., Azure.Messaging.EventGrid, Azure.Identity) to be installed via the dotnet CLI. These packages are hosted on the standard NuGet registry and originate from a trusted organization.
- Network Operations: The skill describes how to publish events to Azure Event Grid endpoints (*.eventgrid.azure.net). These network operations are necessary for the skill's primary function of event messaging and target well-known cloud service domains.
- Data Ingestion (Indirect Prompt Injection Surface): The skill provides examples of parsing external JSON data from event payloads using
EventGridEvent.ParseMany. While this is a core requirement for event processing, it represents an ingestion point where untrusted data enters the application context. - Ingestion points: Event parsing logic in
SKILL.mdusingBinaryData.FromString(json). - Boundary markers: None explicitly defined in the documentation examples to distinguish between event metadata and potentially untrusted data content.
- Capability inventory: The skill includes network writing capabilities via
EventGridPublisherClient.SendEventAsyncand console logging. - Sanitization: The code examples use
TryGetSystemEventDataandToObjectFromJson<T>, which provide structural validation but do not inherently sanitize the content of the event data. - Dynamic Data Deserialization: The use of
ToObjectFromJson<MyCustomData>involves the dynamic deserialization of JSON strings into object instances. This is a standard pattern for the System.Text.Json library used by the Azure SDK and is generally safe when used with known types.
Audit Metadata