dotnet-inspect-decompiler

Pass

Audited by Gen Agent Trust Hub on Aug 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes the dnx command-line runner to execute the dotnet-inspect utility for member and type analysis. This is the intended behavior for an introspection tool.
  • [EXTERNAL_DOWNLOADS]: The tool may access the network to retrieve NuGet packages or PDB symbol files to improve decompilation accuracy. The documentation clearly specifies that the --offline flag can be used to prevent all network access.
  • [PROMPT_INJECTION]: The skill processes untrusted binary files and translates them into C# source, which represents a surface for indirect prompt injection. 1. Ingestion points: .NET assemblies (DLLs) and project source directories. 2. Boundary markers: The skill labels outputs into distinct sections such as Decompiled Source and Annotated Source. 3. Capability inventory: Command execution via dnx dotnet-inspect. 4. Sanitization: The decompiler includes a fidelity model with diagnostic codes (DEC####) that signal when the output is not a faithful reconstruction.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 22, 2026, 10:38 PM
Security Audit — agent-trust-hub — dotnet-inspect-decompiler