skills/tebjan/vvvv-skills/vvvv-dotnet/Gen Agent Trust Hub

vvvv-dotnet

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for using standard .NET command-line tools, including dotnet build for compilation checks and nuget pack for distributing plugins.
  • [EXTERNAL_DOWNLOADS]: The documentation suggests configuring NuGet.config to include the official vvvv TeamCity guest feed at https://teamcity.vvvv.org/guestAuth/app/nuget/v1/FeedService.svc/ for accessing ecosystem-specific packages.
  • [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The AsyncLoader template in SKILL.md accepts a url parameter in its Update method. 2. Boundary markers: The provided code snippet does not include delimiters or instructions to ignore embedded commands in the fetched data. 3. Capability inventory: The template uses Task.Run to perform background operations based on the input URL. 4. Sanitization: The example lacks sanitization or validation for the remote content being loaded, which represents an attack surface for the agent if instructions are embedded in the fetched data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 08:43 AM