csharp-spector-coverage-gaps
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Dependency Installation: The skill uses
npm cito install project dependencies from the NPM registry. This is a common practice in Node.js development but involves downloading external code.\n- Command Execution: The skill executes local PowerShell scripts (Spector-Helper.psm1,Generate.ps1,Test-Spector.ps1) and standard CLI tools (dotnet,npm) to automate the build and test lifecycle.\n- Dynamic Code Generation: The skill generates C# code and executes it viadotnet test. This is necessary for implementing and verifying test coverage based on the specifications.\n- Indirect Prompt Injection Surface: The skill processes TypeSpec files to determine expected behavior, which could potentially serve as a surface for indirect instructions.\n - Ingestion points: Spector scenario files (
main.tsp,client.tsp) located innode_modulesor specific spec paths.\n - Capability inventory: File system write operations for C# tests, execution of local scripts, and build/test command invocation.\n
- Boundary markers: No specific delimiters or safety warnings for embedded instructions are specified in the workflow.\n
- Sanitization: The instructions do not describe sanitization or validation of the TypeSpec content before it is used to influence code generation.
Audit Metadata