dotnet-inspect-private-feeds
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses on providing documentation and command-line examples for interacting with private NuGet package feeds. It emphasizes secure secret management by instructing users to keep tokens out of repositories and command lines, favoring the use of environment variables and official credential providers.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the Microsoft Artifacts Credential Provider via the official .NET tool installer (
dotnet tool install). As this targets a well-known service and a trusted organization, the reference is documented as a standard development workflow and does not introduce malicious risks. - [INDIRECT_PROMPT_INJECTION]: The skill describes a capability to ingest and process data from external NuGet feeds and local package sources.
- Ingestion points: Data enters the context through NuGet feed metadata,
NuGet.Configfiles, and local folder paths provided via the--sourceor--nugetconfigflags (SKILL.md). - Boundary markers: None explicitly defined in the provided documentation snippets.
- Capability inventory: The tool performs network operations to reach NuGet API endpoints and local file reads to inspect package contents (SKILL.md).
- Sanitization: The skill describes the tool as having specific logic to reject private-feed source overrides for certain commands to prevent querying the wrong authority, which acts as a form of validation.
Audit Metadata