dotnet-tooling
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches official .NET SDK installation scripts and credential providers from Microsoft's trusted domains (dot.net and aka.ms).
- [REMOTE_CODE_EXECUTION]: Provides instructions to execute .NET installation scripts and the Azure Artifacts Credential Provider setup script directly via the shell. These actions use resources from well-known Microsoft infrastructure.
- [PERSISTENCE]: Recommends updating shell profile files (~/.bashrc, ~/.zshrc) to persist .NET environment variables such as DOTNET_ROOT and PATH, ensuring the SDK remains available across sessions.
- [DYNAMIC_EXECUTION]: Documents the use of MSBuild CodeTaskFactory for authoring inline build tasks in C#, which involves runtime compilation and execution of code within the MSBuild engine as part of the build process.
- [INDIRECT_PROMPT_INJECTION]: The skill's project analysis features involve scanning and reading the contents of .NET project files (.csproj, .sln, .slnx, Directory.Build.props) and source code. This creates a surface where instructions embedded in project files could potentially influence the agent's reasoning.
- [COMMAND_EXECUTION]: Uses various development commands (dotnet build, dotnet restore, find, grep) and a specialized Python script (scripts/scan-dotnet-targets.py) to analyze the project environment and manage build tasks.
Audit Metadata