convert-to-cpm — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited convert-to-cpm (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 7 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 9 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Centralize package versions in Directory.Packages.props while preserving project behavior and producing reviewable before/after evidence.
Do this before running builds or changing files.
packages.config, stop. Explain that CPM requires PackageReference and recommend migrating first. Do not create or modify files.global.json. Ask only when the version or alignment policy is ambiguous. Do not create or modify Directory.Packages.props, remove versions for CPM, or capture conversion artifacts. Complete the package work, then recommend CPM as the durable follow-up.If the scope is unclear, ask once before proceeding.
This plan is an efficiency default, not a hard cap. Never omit an in-scope project, imported .props/.targets file, detected complexity, required validation, or deliverable to save a turn. Batch complete work where practical.
| Input | Required | Rule |
|---|---|---|
| Scope | Yes | Project, solution, or directory containing the projects to inspect or convert |
| Conflict strategy | For package maintenance or conversion with conflicts | If the user already supplied a strategy such as "use the highest version," apply it without asking again and record its impact. Otherwise stop after the audit and ask before editing. |
Never preload all references.
| Condition | Read |
|---|---|
| Entering conversion baseline or producing the package diff | baseline-comparison.md |
A conflict, conditional reference, shared import, security concern, or VersionOverride is detected | audit-complexities.md |
Placement is unclear or conditional PackageVersion/VersionOverride is required | directory-packages-props.md |
| A package version uses an MSBuild property | msbuild-property-handling.md |
| Restore or build fails after conversion | validation-and-errors.md |
| Writing the final report | report-template.md |
.sln/.slnx, then add each project not covered by a solution. Verify that every in-scope project is covered and avoid duplicate work for projects that occur in more than one target. Ask only when overlapping targets or repository boundaries make the intended coverage ambiguous; never ask the user to select one target when that would omit in-scope projects.Directory.Packages.props at each group's first common ancestor, while respecting existing nearest-file boundaries. Multiple CLI targets can share one CPM file; independent project groups can require separate files.packages.config; if found, switch to Guard mode and stop.Directory.Packages.props. If CPM is already fully enabled, report that and stop. If a partial file exists, preserve it and ask only when its intended scope is ambiguous.global.json, not from an unrelated parent workspace.Read baseline-comparison.md. For each target, determine the active SDK once from that target's command directory and select the documented command syntax for that version. If SDK resolution fails or the SDK cannot process the requested solution format, stop and report the prerequisite; do not alter the host SDK or repository SDK policy unless the user asks.
Then use one command batch to:
baseline.binlog for one target or a unique baseline-<target-key>.binlog for each of multiple targets.baseline-packages.json for one target or a matching baseline-packages-<target-key>.json for each of multiple targets.Finish every baseline before editing. If any baseline build fails, stop without modifying files and preserve all artifacts already produced.
Use all baseline snapshots plus one targeted scan of in-scope project, .props, and .targets files. Identify:
PackageReference itemsVersionOverride usageFor a complex scope, complete every applicable item above across all projects and imported files; do not stop after finding the first conflict.
Do not run broad --outdated or --deprecated scans by default. Before editing, attempt a scoped --vulnerable --include-transitive query when the user requested security information, a known advisory must be verified, or conflict resolution will move a project across a major package version. Record the compact findings, "no advisories found," or why the check could not run. If a high-risk check is unavailable because of authentication, package-source, or offline constraints, surface the uncertainty and confirm the user's strategy rather than silently treating it as safe. Do not upgrade beyond the highest version already in scope as part of a CPM conversion.
Present conflicts and their impact. Explicitly classify major-version alignment as high risk and minor/patch alignment as moderate risk without performing an extra online scan. If the user supplied a conflict strategy, proceed. Otherwise ask for the unresolved decisions and stop before editing.
Directory.Packages.props at its computed management scope with ManagePackageVersionsCentrally set to true.PackageVersion per package, preserving required target-framework conditions.Version from managed PackageReference items in projects and imported files.PrivateAssets, IncludeAssets, ExcludeAssets, GeneratePathProperty, and Aliases.VersionOverride only when the chosen strategy requires it.For MSBuild version properties, follow msbuild-property-handling.md. When the user directs inlining, include both the literal PackageVersion and removal of the obsolete property definition in the same mutation batch. Before final validation, verify separately that:
$(PropertyName) references remain in scoped project, .props, or .targets files.<PropertyName>...</PropertyName> definition remains for each property chosen for removal.Do not rely on a $() reference scan to prove that the XML property definition was removed.
Using baseline-comparison.md, validate the final on-disk state after all project, shared-file, and property edits. Use one command batch to:
after-cpm.binlog for one target or a matching after-cpm-<target-key>.binlog for each of multiple targets.after-cpm-packages.json for one target or a matching after-cpm-packages-<target-key>.json for each of multiple targets.--no-build --no-restore and record the result. If tests require substantial setup, broad infrastructure, or user approval, recommend the exact scoped command instead. A version-neutral conversion does not require an automatic test run.If restore or build fails with a CPM-related error, read validation-and-errors.md, inspect only the relevant error lines, make a targeted correction, and rerun the affected validation. For SDK, authentication, package-source, file-lock, test-host, or other environmental failures, report the blocker instead of changing the machine or expanding the investigation.
If a test run fails after a successful build, inspect only enough output to determine whether CPM package resolution caused it. Apply a targeted correction only when the evidence clearly identifies a CPM defect; otherwise record the failure and recommended user action without expanding into test-host, SDK, output-directory, or dependency-copy debugging.
Read report-template.md now, not earlier. Create convert-to-cpm.md beside the other artifacts. It must include the six required sections, every explicit target and CPM management scope, concrete conflict impacts, the aggregate package comparison, risk level, follow-ups, artifact usage, and the name of every shared .props/.targets file inspected or changed. In the final response, mention those shared files, the risk level, and how any conditional references and target frameworks were preserved. Avoid rewriting the report after validation unless verification finds an omission or incorrect evidence.
Preserve the report and every target's four evidence files; they are not temporary files. For one target, the five deliverables are:
baseline.binlogafter-cpm.binlogbaseline-packages.jsonafter-cpm-packages.jsonconvert-to-cpm.mdFor multiple targets, replace the four fixed evidence names with unique target-keyed pairs such as baseline-api.binlog, after-cpm-api.binlog, baseline-packages-api.json, and after-cpm-packages-api.json. Keep one aggregate convert-to-cpm.md.
PackageReference has no Version, or intentionally uses VersionOverridePackageVersion$() references nor obsolete XML definitions~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.