vstest-build-test
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill executes repository-local scripts such as
./build.sh,./build.cmd,./test.sh, and./test.cmdto manage the build and test lifecycle. It also includes utility logic to remove specific project-related directories (.dotnet,.packages,artifacts) when an environment mismatch is detected, which is a common pattern for maintaining clean build states. - External Downloads: The skill refers to an automated process where the .NET SDK is bootstrapped based on the repository's configuration. These downloads originate from Microsoft's official distribution infrastructure, which is consistent with the skill's focus on the vstest project.
- Indirect Prompt Injection: The skill accepts user-provided input for project paths and test filters (e.g., via the
-filteror--projectsparameters). This allows the agent to target specific tests or components. While this introduces a surface for processing arbitrary strings, it is a standard and necessary feature for testing tools and is used within the context of the repository's build system.
Audit Metadata