dotnet-maui-doctor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dotnet-maui-doctor (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 7 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 7 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Validate and fix .NET MAUI development environments. All version requirements are discovered dynamically from NuGet APIs — never hardcode versions.
Your training data may be outdated regarding .NET versions. .NET ships new major releases annually (November). Always check the releases-index.json (Task 2) to discover the latest active major release — do not assume your training data reflects the current version. For example, if you know about .NET 9.0 but the releases index shows .NET 10.0 as active, use .NET 10.0.
curl, jq, and unzip (macOS/Linux)Invoke-RestMethod and System.IO.Compression (built-in on Windows)# macOS
sw_vers && uname -m
# Windows
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
# Linux
cat /etc/os-release && uname -mAfter detection, load the matching platform references:
references/platform-requirements-macos.md, references/installation-commands-macos.md, references/troubleshooting-macos.mdreferences/platform-requirements-windows.md, references/installation-commands-windows.md, references/troubleshooting-windows.mdreferences/platform-requirements-linux.mddotnet --infoCompare installed vs latest-sdk from https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/releases-index.json where support-phase is "active".
| Workload | macOS | Windows | Linux |
|---|---|---|---|
maui | Required | Required | ❌ Use maui-android |
maui-android | Alias | Alias | Required |
android | Required | Required | Required |
ios | Required | Optional | N/A |
See references/workload-dependencies-discovery.md for complete process.
Query NuGet for workload manifest → extract WorkloadDependencies.json → get:
jdk.version range and jdk.recommendedVersionandroidsdk.packages, buildToolsVersion, apiLevelxcode.version rangeOnly Microsoft OpenJDK supported. Verify java -version output contains "Microsoft". See references/microsoft-openjdk.md for detection paths.
Use the JDK version recommended by WorkloadDependencies.json (jdk.recommendedVersion), ensuring it satisfies thejdk.versionrange. Do not hardcode JDK versions.
JAVA_HOME is NOT required. .NET MAUI tools auto-detect Microsoft OpenJDK installations from known paths. Do not tell users to set JAVA_HOME — it is unnecessary and risks pointing to a non-Microsoft JDK.
| JAVA_HOME state | OK? | Action |
|---|---|---|
| Not set | ✅ | None needed — auto-detection works |
| Set to Microsoft JDK | ✅ | None needed |
| Set to non-Microsoft JDK | ⚠️ | Report as anomaly — let user decide to unset or redirect |
Check packages from androidsdk.packages, buildToolsVersion, apiLevel (Task 4). See references/installation-commands.md for sdkmanager commands.
xcodebuild -versionCompare against xcode.version range from Task 4. See references/installation-commands-macos.md.
The Windows SDK is typically installed as part of the .NET MAUI workload or Visual Studio. See references/installation-commands-windows.md.
See references/installation-commands.md for all commands.
Key rules:
--version flag. Never use workload update or workload repair.sdkmanager (from Android SDK command-line tools). On Windows use sdkmanager.bat.After each fix, re-run the relevant validation task. Iterate until all checks pass.
A successful run produces:
java -version contains "Microsoft")After all checks pass, create and build a test project to confirm the environment actually works:
TEMP_DIR=$(mktemp -d)
dotnet new maui -o "$TEMP_DIR/MauiTest"
dotnet build "$TEMP_DIR/MauiTest"
rm -rf "$TEMP_DIR"On Windows, use $env:TEMP or New-TemporaryFile for the temp directory.
If the build succeeds, the environment is verified. If it fails, use the error output to diagnose remaining issues.
After a successful build, ask the user if they want to launch the app on a target platform to verify end-to-end:
# Replace net10.0 with the current major .NET version
dotnet build -t:Run -f net10.0-android
dotnet build -t:Run -f net10.0-ios # macOS only
dotnet build -t:Run -f net10.0-maccatalyst # macOS only
dotnet build -t:Run -f net10.0-windows # Windows onlyOnly run the target frameworks relevant to the user's platform and intent. This step deploys to an emulator/simulator/device, so confirm with the user before proceeding.
maui meta-workload is not available — use maui-android instead. On macOS/Windows, maui installs all platform workloads.--version flag to ensure version consistency.sdkmanager.bat, not sdkmanager, on Windows.references/workload-dependencies-discovery.md — NuGet API discovery processreferences/microsoft-openjdk.md — JDK detection paths, identification, JAVA_HOMEreferences/installation-commands.md — .NET workloads, Android SDK (sdkmanager)references/troubleshooting.md — Common errors and solutionsreferences/platform-requirements-{platform}.md — Platform-specific requirementsreferences/installation-commands-{platform}.md — Platform-specific install commandsreferences/troubleshooting-{platform}.md — Platform-specific troubleshootingOfficial docs:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.