aspnet-core
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to assist with ASP.NET Core development, which involves processing user-provided source code and project files, creating an inherent surface for indirect prompt injection.
- Ingestion points: User-provided C# source code, project files (.csproj), and architectural descriptions as seen in SKILL.md.
- Boundary markers: Absent. The provided templates do not include specific delimiters or instructions to ignore embedded commands in user-provided files.
- Capability inventory: The skill specifies the use of 'dotnet build', 'dotnet run', and 'dotnet test' which involve the execution of compiled code within the project context.
- Sanitization: Absent. No explicit sanitization or validation logic is provided for the input project data.
- [EXTERNAL_DOWNLOADS]: The skill references official and trusted external resources for development and deployment.
- Evidence: Pulls official .NET SDK and runtime images from 'mcr.microsoft.com' in the Dockerfile within references/patterns.md.
- Evidence: Recommends installing the 'dotnet-ef' tool, a standard Microsoft-supported utility, from the NuGet registry.
- Evidence: Includes well-known and trusted dependencies such as FluentValidation, Serilog, xUnit, and Testcontainers.
- [COMMAND_EXECUTION]: The skill defines a set of standard .NET CLI commands used for common development lifecycle tasks.
- Evidence: Includes commands for project restoration, compilation, testing, and database migration management in SKILL.md.
Audit Metadata