skills/kevintsengtw/dotnet-testing-agent-skills/dotnet-testing-advanced-testcontainers-database/Gen Agent Trust Hub
dotnet-testing-advanced-testcontainers-database
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates that load SQL scripts from the local file system using
File.ReadAllTextand execute them directly against a database usingExecuteSqlRawor Dapper'sExecutemethod intemplates/dapper-integration-tests.csandtemplates/mssql-collection-fixture.cs. - [CREDENTIALS_UNSAFE]: Multiple C# code templates and reference files contain hardcoded passwords (e.g., "Test123456!", "testpass", "YourStrong@Passw0rd") for initializing local Docker test containers for SQL Server and PostgreSQL.
- [INDIRECT_PROMPT_INJECTION]: The skill implements a pattern for reading and executing external SQL files, creating a vulnerability surface where malicious SQL content could be executed if the source files are compromised.
- Ingestion points: SQL files in the
SqlScriptsdirectory read viaFile.ReadAllTextintemplates/dapper-integration-tests.csandtemplates/mssql-collection-fixture.cs. - Boundary markers: Absent.
- Capability inventory: Database command execution via
ExecuteSqlRawandExecutein multiple files. - Sanitization: Absent; SQL content is read and executed without validation or filtering.
Audit Metadata