ln-822-nuget-upgrader
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes several .NET CLI commands, such as
dotnet build,dotnet test, anddotnet restore, which trigger the execution of code within the project's context. - [EXTERNAL_DOWNLOADS]: Installs the
dotnet-outdated-toolas a global .NET tool. This tool is a community package hosted on the NuGet registry, which is a well-known service provided by Microsoft. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by reading and processing external XML data from
.csprojand.slnfiles. - Ingestion points: Files with
.csprojand.slnextensions are discovered and read recursively from the local filesystem (SKILL.md, Phase 1). - Boundary markers: The skill does not implement specific boundary markers or instructions to disregard embedded commands when reading package metadata from project files.
- Capability inventory: The skill has the capability to install tools, modify project configurations, and execute build/test binaries (SKILL.md, Phases 3, 5, 6).
- Sanitization: No validation or sanitization of the input file content is documented before it is used to determine migration logic or execute commands.
Audit Metadata