initialize-ef-core-dbcontext

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to facilitate database scaffolding and project verification. This includes git status, efcpt (EF Core Power Tools CLI) for generating the database context, and dotnet build. These operations are standard for the described development task and are consistent with the skill's stated purpose.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by instructing the agent to process and apply configurations based on external files like efcpt-readme.md, Program.cs, and appsettings.json. (1) Ingestion points: Program.cs, appsettings.json, and the tool-generated efcpt-readme.md. (2) Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts within these files. (3) Capability inventory: Subprocess execution via efcpt and dotnet build, and file-system write operations for project configuration. (4) Sanitization: No content validation or escaping is described. While this represents a potential attack surface if the ingested files are compromised, it is intrinsic to the skill's function of project configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 04:44 AM