build-tools-tests

Warn

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill permits the agent to generate and execute C# code within the demo-site/ directory to facilitate test environment configuration.
  • [COMMAND_EXECUTION]: The skill uses several shell commands, including npm run compile, npm test, dotnet build, dotnet run, and pkill, to manage the test lifecycle and control the running Umbraco instance.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing NuGet packages using the dotnet add command, which allows for the inclusion of external code dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by reading .discover.json and tool source files to drive the generation of test code and builders.
  • Ingestion points: The skill reads .discover.json and multiple TypeScript tool files within src/umbraco-api/tools/.
  • Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present.
  • Capability inventory: The skill has file-writing access across the project and can execute shell commands like npm, dotnet, and pkill.
  • Sanitization: The instructions do not specify any sanitization or validation of the input content before it is used in the code generation process.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 2, 2026, 05:20 PM