dotnet-inspect-compatibility

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of .NET packages and source code from external repositories.
  • It utilizes well-known services like raw.githubusercontent.com for SourceLink integration.
  • The documentation explicitly describes a security feature where fetched source code is verified against PDB checksums before being processed.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting and analyzing external, untrusted data (compiled DLLs and source code) which could potentially contain malicious instructions.
  • Ingestion points: External data enters the context through local library paths (--library), remote NuGet packages (--package), and SourceLink URLs.
  • Boundary markers: The instructions do not specify explicit boundary markers or instructions for the agent to ignore embedded commands within the analyzed code.
  • Capability inventory: The skill is scoped to code analysis, decompilation (C#), and metadata inspection. It does not contain capabilities for arbitrary file writing or persistence.
  • Sanitization: The skill recommends structured output formats such as --table, --tsv, and --jsonl, which helps delineate analysis results from the agent's execution logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 09:12 AM
Security Audit — agent-trust-hub — dotnet-inspect-compatibility