vvvv-dotnet
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for using standard .NET command-line tools, including
dotnet buildfor compilation checks andnuget packfor distributing plugins. - [EXTERNAL_DOWNLOADS]: The documentation suggests configuring
NuGet.configto include the official vvvv TeamCity guest feed athttps://teamcity.vvvv.org/guestAuth/app/nuget/v1/FeedService.svc/for accessing ecosystem-specific packages. - [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The
AsyncLoadertemplate inSKILL.mdaccepts aurlparameter in itsUpdatemethod. 2. Boundary markers: The provided code snippet does not include delimiters or instructions to ignore embedded commands in the fetched data. 3. Capability inventory: The template usesTask.Runto perform background operations based on the input URL. 4. Sanitization: The example lacks sanitization or validation for the remote content being loaded, which represents an attack surface for the agent if instructions are embedded in the fetched data.
Audit Metadata