aspire
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Remote Code Execution Pattern: The skill provides instructions to download and execute a setup script from the official aspire.dev domain (curl -sSL https://aspire.dev/install.sh | bash). While this is a standard installation method for the Aspire CLI, it involves executing code from a remote source.
- Indirect Prompt Injection Surface: The skill identifies tasks by scanning repository files such as .csproj, apphost.cs, apphost.ts, and aspire.config.json for specific markers. This ingestion of data from the user's workspace serves as a potential surface for indirect instructions, as no specific boundary markers or sanitization steps are defined for these inputs in the routing logic.
Audit Metadata