dotnet-inspect-compatibility
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of .NET packages and source code from external repositories.
- It utilizes well-known services like
raw.githubusercontent.comfor SourceLink integration. - The documentation explicitly describes a security feature where fetched source code is verified against PDB checksums before being processed.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting and analyzing external, untrusted data (compiled DLLs and source code) which could potentially contain malicious instructions.
- Ingestion points: External data enters the context through local library paths (
--library), remote NuGet packages (--package), and SourceLink URLs. - Boundary markers: The instructions do not specify explicit boundary markers or instructions for the agent to ignore embedded commands within the analyzed code.
- Capability inventory: The skill is scoped to code analysis, decompilation (C#), and metadata inspection. It does not contain capabilities for arbitrary file writing or persistence.
- Sanitization: The skill recommends structured output formats such as
--table,--tsv, and--jsonl, which helps delineate analysis results from the agent's execution logic.
Audit Metadata