fsharp-signature-files
Warn
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates temporary F# script files at runtime to perform API analysis. Evidence:
scripts/public-surface.ps1creates aprobe.fsxfile containing F# code and executes it usingdotnet fsi. - [DYNAMIC_EXECUTION]: The analysis script dynamically loads .NET assemblies into the process for inspection via reflection. Evidence:
scripts/PublicSurface.fsxusesAssemblyLoadContext.LoadFromAssemblyPathto load target DLLs and their dependencies from local paths and NuGet package directories. - [COMMAND_EXECUTION]: The skill relies on executing shell commands for building projects and running verification tests. Evidence:
SKILL.mdandscripts/run.ps1usedotnet build,dotnet fsi, andpwshto perform their tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes external binary data (compiled assemblies) which could potentially contain malicious logic triggered during loading or reflection. Ingestion points: Assembly files provided via the
-Assemblyargument inscripts/public-surface.ps1. Boundary markers: None present in the instructions or script outputs. Capability inventory: The skill can build projects, execute F# scripts, and load assemblies. Sanitization: Includes basic string escaping for generated scripts inConvertTo-FSharpString.
Audit Metadata