mirror of
https://github.com/dotnet/skills.git
synced 2026-09-20 09:49:54 +08:00
Dan Moseley
b966ac4dec
* Add structural external dependency checker for skills, agents, and plugins Add ExternalDependencyChecker to the skill-validator that produces advisory warnings for structural dependencies that need human review: - Script files in skill scripts/ directories (.ps1, .sh, .py, .bat, .cmd, .bash) - INVOKES patterns referencing external scripts in skill descriptions - #tool: references to non-built-in tools in skill/agent content - Non-built-in tools declared in agent frontmatter tools array - MCP server declarations in plugin.json files URL scanning is intentionally excluded — it is handled by the reference scanner (eng/reference-scanner/scan.ps1) with its known-domains.txt allowlist. Also adds Tools property to AgentInfo record and RawAgentFrontmatter to support parsing the tools array from agent YAML frontmatter. Based on dotnet/skills#337 by ManishJayaswal, trimmed to structural checks only (URL scanning superseded by #336). Co-authored-by: ManishJayaswal <ManishJayaswal@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add allowlist support for external dependency checker Introduce an allowlist file (eng/skill-validator/allowed-external-deps.txt) so known external dependencies can be pre-approved. Each finding generates a deterministic key (type:name:detail) that is checked against the list. Allowed items are silently suppressed; unrecognized entries produce warnings. The allowlist is pre-seeded with the 5 findings currently on main so the checker runs clean out of the box. Over time, entries can be removed as issues are resolved, and checks can be promoted to hard errors. Adds 7 tests covering allowlist loading and filtering. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address review feedback: naming, dedup, test robustness - Rename 'errors' variables to 'findings' in all Check* methods to reflect advisory (warning) semantics, not hard failures. - Rename test methods from FlagsError to FlagsWarning, NoError to NoWarning for consistency. - De-duplicate #tool: reference warnings so repeated mentions of the same tool in a skill/agent produce only one finding. - Use GUID-based temp path instead of hardcoded '/nonexistent/path.txt' in LoadAllowList_MissingFile test. - Add 2 dedup tests (skill and agent) bringing total to 379. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix comments: tool refs scan full content, not just body Update comments in CheckSkill and CheckAgent to accurately reflect that #tool: references are scanned in the full markdown content (including frontmatter), not just the body. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: ManishJayaswal <ManishJayaswal@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>