fsharp-signature-files

Warn

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates temporary F# script files at runtime to perform API analysis. Evidence: scripts/public-surface.ps1 creates a probe.fsx file containing F# code and executes it using dotnet fsi.
  • [DYNAMIC_EXECUTION]: The analysis script dynamically loads .NET assemblies into the process for inspection via reflection. Evidence: scripts/PublicSurface.fsx uses AssemblyLoadContext.LoadFromAssemblyPath to load target DLLs and their dependencies from local paths and NuGet package directories.
  • [COMMAND_EXECUTION]: The skill relies on executing shell commands for building projects and running verification tests. Evidence: SKILL.md and scripts/run.ps1 use dotnet build, dotnet fsi, and pwsh to perform their tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external binary data (compiled assemblies) which could potentially contain malicious logic triggered during loading or reflection. Ingestion points: Assembly files provided via the -Assembly argument in scripts/public-surface.ps1. Boundary markers: None present in the instructions or script outputs. Capability inventory: The skill can build projects, execute F# scripts, and load assemblies. Sanitization: Includes basic string escaping for generated scripts in ConvertTo-FSharpString.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 14, 2026, 03:52 AM