The Agent Skills Directory

Command Execution: The skill utilizes dotnet CLI commands to perform operations such as running tests, adding packages, and installing global tools (e.g., dotnet-coverage, dotnet-reportgenerator-globaltool). These are standard operations within the .NET development lifecycle and are used here to facilitate the metrics collection required for CRAP score analysis.
Indirect Prompt Injection: The skill processes external source code and XML coverage reports. Ingesting untrusted external data is a potential vulnerability surface; however, this skill incorporates several validation steps to mitigate risks. Evidence includes:
Ingestion points: The skill reads source files and Cobertura XML reports (Step 1 and Step 3).
Boundary markers: The instructions mandate reporting data conflicts and stopping analysis if report integrity is questionable.
Capability inventory: Capabilities include local shell command execution via the dotnet CLI.
Sanitization: The skill performs integrity checks by cross-referencing line-rate attributes against actual line hits and verifying that reports are not empty or misaligned with the target scope.

crap-score