including-generated-files — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited including-generated-files (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 7 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 7 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Files generated during the build are generally ignored by the build process. This leads to confusing results such as:
This happens because of how MSBuild's build phases work.
For code files generated during the build - we need to add those to Compile and FileWrites item groups within the target generating the file(s):
<ItemGroup>
<Compile Include="$(GeneratedFilePath)" />
<FileWrites Include="$(GeneratedFilePath)" />
</ItemGroup>The target generating the file(s) should be hooked before CoreCompile and BeforeCompile targets - BeforeTargets="CoreCompile;BeforeCompile"
For detailed explanation, see How MSBuild Builds Projects.
MSBuild reads your project, imports everything, creates Properties, expands globs for Items outside of Targets, and sets up the build process.
MSBuild runs Targets & Tasks with the provided Properties & Items to perform the build.
Key Takeaway: Files generated during execution don't exist during evaluation, therefore they aren't found. This particularly affects files that are globbed by default, such as source files (.cs).
When files are generated during the build, manually add them into the build process. The approach depends on the type of file being generated.
$(IntermediateOutputPath) for Generated File LocationAlways use $(IntermediateOutputPath) as the base directory for generated files. Do not hardcode obj\ or construct the intermediary path manually (e.g., obj\$(Configuration)\$(TargetFramework)\). The intermediate output path can be redirected to a different location in some build configurations (e.g., shared output directories, CI environments). Using $(IntermediateOutputPath) ensures your target works correctly regardless of the actual path.
FileWritesEvery generated file should be added to the FileWrites item group. This ensures that MSBuild's Clean target properly removes your generated files. Without this, generated files will accumulate as stale artifacts across builds.
<ItemGroup>
<FileWrites Include="$(IntermediateOutputPath)my-generated-file.xyz" />
</ItemGroup>For generated files that need to be copied to output (config files, data files, etc.), add them to Content or None items before BeforeBuild:
<Target Name="IncludeGeneratedFiles" BeforeTargets="BeforeBuild">
<!-- Your logic that generates files goes here -->
<ItemGroup>
<None Include="$(IntermediateOutputPath)my-generated-file.xyz" CopyToOutputDirectory="PreserveNewest"/>
<!-- Capture all files of a certain type with a glob -->
<None Include="$(IntermediateOutputPath)generated\*.xyz" CopyToOutputDirectory="PreserveNewest"/>
<!-- Register generated files for proper cleanup -->
<FileWrites Include="$(IntermediateOutputPath)my-generated-file.xyz" />
<FileWrites Include="$(IntermediateOutputPath)generated\*.xyz" />
</ItemGroup>
</Target>If you're generating .cs files that need to be compiled, use `BeforeTargets="CoreCompile;BeforeCompile"`. This is the correct timing for adding Compile items — it runs late enough that the file generation has occurred, but before the compiler runs. Using BeforeBuild is too early for some scenarios and may not work reliably with all SDK features.
<Target Name="IncludeGeneratedSourceFiles" BeforeTargets="CoreCompile;BeforeCompile">
<PropertyGroup>
<GeneratedCodeDir>$(IntermediateOutputPath)Generated\</GeneratedCodeDir>
<GeneratedFilePath>$(GeneratedCodeDir)MyGeneratedFile.cs</GeneratedFilePath>
</PropertyGroup>
<MakeDir Directories="$(GeneratedCodeDir)" />
<!-- Your logic that generates the .cs file goes here -->
<ItemGroup>
<Compile Include="$(GeneratedFilePath)" />
<FileWrites Include="$(GeneratedFilePath)" />
</ItemGroup>
</Target>Note: Specifying both CoreCompile and BeforeCompile ensures the target runs before whichever target comes first, providing robust ordering regardless of customizations in the build.
Choose the BeforeTargets value based on the type of file being generated:
None or Content. Runs early enough for copy-to-output scenarios.Compile. Ensures the file is included before the compiler runs.None and Content items (among others) are transformed into new items. Use as a fallback if BeforeBuild is too early.Globs behave according to when the glob took place:
| Glob Location | Files Captured |
|---|---|
| Outside of a target | Only files visible during Evaluation phase (before build starts) |
| Inside of a target | Files visible when the target runs (can capture generated files if timed correctly) |
This is why the solution places the <ItemGroup> inside a <Target> - the glob runs during execution when the generated files exist.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.