The Agent Skills Directory

[COMMAND_EXECUTION]: The skill authorizes a wide range of dotnet CLI subcommands through the Bash tool, including nuget why, list, package search, add package, and tool. This provides the agent with significant control over the local development environment and project configuration.
[REMOTE_CODE_EXECUTION]: Capabilities such as dotnet add package and dotnet tool install/update are equivalent to remote code execution. NuGet packages can execute code during the build process via MSBuild targets, and .NET tools are arbitrary executable binaries downloaded from external sources.
[EXTERNAL_DOWNLOADS]: The skill is designed to fetch packages and tools from external registries (e.g., NuGet). While typically directed at nuget.org, the allowed-tools configuration does not restrict the agent from adding untrusted package sources or installing malicious packages if instructed to do so.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. If an agent audits a project containing malicious instructions embedded in .csproj files, nuget.config, or package metadata, it could be manipulated into executing dangerous commands using its available dotnet and Bash capabilities.
Ingestion points: Project files (.csproj), package lists, and search results processed via dotnet list and grep.
Boundary markers: None identified in the prompt instructions to distinguish between data and instructions.
Capability inventory: The agent can add/remove packages, update tools, and execute shell commands via Bash.
Sanitization: No sanitization or validation of package IDs or tool names is implemented before execution.

dotnet-dependency