dotnet-messaging-patterns
Pass
Audited by Gen Agent Trust Hub on Feb 24, 2026
Risk Level: SAFECREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The MassTransit configuration example includes hardcoded default credentials (
Username("guest"),Password("guest")). While these are standard defaults for RabbitMQ local environments, they are flagged as hardcoded secrets. The skill's 'Agent Gotchas' section mitigates this by explicitly advising against hardcoding connection strings in production. - [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by documenting how to consume and process data from external message brokers.
- Ingestion points: Data enters the agent's processing context through
ServiceBusProcessor.ProcessMessageAsyncand MassTransitIConsumerimplementations inSKILL.md. - Boundary markers: There are no boundary markers or instructions to treat message content as untrusted data.
- Capability inventory: The skill shows consumers interacting with databases (
db.SaveChangesAsync) and publishing new messages (publishEndpoint.Publish). - Sanitization: The examples show direct deserialization of message bodies (
ToObjectFromJson<OrderPlaced>) without content validation or sanitization.
Audit Metadata