optimize-dotnet-code
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands for profiling and project evaluation, which involves running the target application and MSBuild.\n
- Evidence: Commands such as
dotnet msbuild,dotnet-counters collect ... -- dotnet App.dll, anddotnet-trace collect ... -- dotnet App.dllinreferences/measurement-and-runtime.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where it ingests untrusted data (user-provided .NET code, project files, and binaries) and uses them as arguments for shell commands that execute code.\n - Ingestion points: .NET project files (
App.csproj) and compiled binaries (App.dll) provided by the user, as referenced inreferences/measurement-and-runtime.md.\n - Boundary markers: Absent. There are no instructions for the agent to use delimiters or ignore instructions embedded in the project files or metadata.\n
- Capability inventory: The skill uses shell execution capabilities to run build and diagnostic tools on the ingested data.\n
- Sanitization: Absent. There is no requirement to validate or sanitize the project file structure or the binary's provenance before execution.
Audit Metadata