build-custom-agent
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the .NET CLI for project operations such as building the application, managing development-time secrets, and executing tests. These commands are standard for the intended developer workflow and do not exhibit malicious patterns.\n- [DYNAMIC_EXECUTION]: Local C# scripts included in the skill are executed via
dotnet runto handle project initialization and verification. These scripts contain internal safety checks to prevent unauthorized file system access and path traversal.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest local documentation and data. It implements a clear response policy and specific agent instructions to ensure that the content of these files is treated as data rather than instructions, effectively mitigating potential injection risks associated with processing external content.\n- [EXTERNAL_DOWNLOADS]: The project fetches standard dependencies from the official NuGet registry and interacts with established cloud services (Azure OpenAI and Progress Observability) for its core functionality. These references target well-known and trusted providers.\n- [DATA_EXFILTRATION]: The agent is configured to send telemetry data to the vendor's observability platform. This is a documented feature used for debugging and monitoring the prototype's performance, using vendor-controlled infrastructure.
Audit Metadata