dotnet-build
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- COMMAND_EXECUTION (LOW): The skill dynamically constructs shell commands using user-provided inputs like
project_path. This presents a risk of command injection if the input is not properly sanitized by the calling agent. Severity is reduced as this is the primary intended function. - EXTERNAL_DOWNLOADS (LOW): The
dotnet restorecommand downloads external dependencies from the NuGet registry. While NuGet is a standard development resource, the skill does not verify the integrity or specific versions of the packages being retrieved, constituting a dependency risk. - PROMPT_INJECTION (LOW): The skill possesses a surface for indirect prompt injection because it processes untrusted project files and user inputs that can influence command execution.
- Ingestion points:
project_pathinput variable; local.slnand.csprojfiles. - Boundary markers: Absent.
- Capability inventory: Shell execution of
dotnet build,dotnet restore, anddotnet cleancommands. - Sanitization: No explicit sanitization or validation of the input strings or file content is defined in the skill documentation.
Audit Metadata