skills/ronnythedev/dotnet-clean-architecture-skills/dotnet-domain-events-generator/Gen Agent Trust Hub
dotnet-domain-events-generator
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The Outbox processor implementation in
ProcessOutboxMessagesJob.csutilizes dynamic type resolution based on values stored in the database. - Evidence: The code calls
Type.GetType(message.Type)wheremessage.Typeis a string retrieved from the databaseOutboxMessagestable. - Risk: This pattern allows for dynamic loading of types based on potentially untrusted data if the database is poisoned (e.g., via SQL injection or access from another compromised service).
- [DYNAMIC_EXECUTION]: The skill implements deserialization of data from the database using a dynamically resolved type, which is a recognized pattern for unsafe deserialization vulnerabilities.
- Evidence:
var domainEvent = JsonSerializer.Deserialize(message.Content, type, JsonOptions) as IDomainEvent;inProcessOutboxMessagesJob.csuses the type resolved at runtime. - Mitigation: Recommended best practice for the Outbox pattern in .NET is to use a fixed whitelist of allowed event types or a dedicated registry rather than resolving arbitrary types from assembly-qualified names stored in the database.
Audit Metadata