Immutable. This exact content is served forever at /api/v1/blob/0d2ed14b1222b9d9.
--- name: dotnet-inspect-signals version: 0.1.0 description: Surface a dependency's observable signals — provenance, compatibility, dependency risk, unsafe/PInvoke surface, artifact-text containment, and identifier confusion — to judge how much caution it warrants. Observations, not verdicts. --- # dotnet-inspect: dependency signals Use this skill to surface the observable signals about a package or library — provenance, build quality, safety surface, and supply-chain — so you can judge how much caution a dependency warrants. dotnet-inspect reports observations, not verdicts: it can give you concrete reasons for caution, not a stamp of trust. ```bash dnx dotnet-inspect -y -- <command> ``` ## The Signals rollup `-S Signals` on `package` or `library` is the one-stop view. It reports SourceLink, determinism, trim/AOT compatibility, memory-safety metadata, unsafe/PInvoke surface, references, TFMs, manifest/docs, license, vulnerabilities, package age, dependency risk, and content-free summaries of artifact-text containment and identifier confusion where applicable. ```bash dnx dotnet-inspect -y -- package Microsoft.Extensions.AI -S Signals dnx dotnet-inspect -y -- library System.Text.Json -S Signals ``` ## Safety and interop surface `-S @Audit` expands the audit sections authored for the target. On libraries it includes `P/Invoke Methods` and `Audit: Identifier Confusion` alongside signals, symbols, and path evidence. `Unsafe Members` is a standalone library section, not a category member; select it by name. On packages, `@Audit` includes `Audit: Artifact Text` and `Audit: Identifier Confusion`. `Switches` is also a separate section; select it explicitly for feature-switch and trim/AOT knobs. (For unsafe operations inside one method, see the `correctness` skill; for what switches mean across versions, see `compatibility`.) ```bash dnx dotnet-inspect -y -- library MyLib.dll -S "@Audit,Switches" dnx dotnet-inspect -y -- library MyLib.dll -S "Unsafe Members,P/Invoke Methods" ``` `Signals` stays summary-only and never repeats a concerning value. Package `Artifact text containment` names the Unicode concern kinds found in package-model fields; its focused audit lists content-free field locations and concern kinds. Package and library `Identifier confusion` summarizes non-ASCII identifiers and reserved-prefix homoglyphs; its focused audit adds content-free locations, classifications, similarity, and code points. The explicit library audit resolves the transitive reference closure, while the Signals row stays bounded to the selected assembly and direct references. ```bash dnx dotnet-inspect -y -- package MyPackage -S "Signals,Audit: Artifact Text" dnx dotnet-inspect -y -- package MyPackage -S "Signals,Audit: Identifier Confusion" dnx dotnet-inspect -y -- library MyLib.dll -S "Signals,Audit: Identifier Confusion" ``` ## SourceLink provenance Distinct from *fetching* source (the `sourcelink` skill), `-S @SourceLink` groups the provenance sections. Library `Signals` distinguishes a present usable map from a partially usable or unusable one; `SourceLink: Diagnostics` reports parse errors and rejected mappings without network access. `SourceLink: Availability` reports whether documents are embedded or reachable, `SourceLink: Integrity` validates their content, and `SourceLink: Missing Files` reports gaps. The document-check sections also aggregate selected libraries on `package`. Availability and missing-file checks may send HEAD requests for uncached SourceLink URLs. The integrity pass fetches and hashes fetchable, non-embedded compiler-source documents, so request these networked checks explicitly. ```bash dnx dotnet-inspect -y -- library System.Text.Json -D @SourceLink dnx dotnet-inspect -y -- library System.Text.Json -D @SourceLink --effective dnx dotnet-inspect -y -- package System.Text.Json -D @SourceLink dnx dotnet-inspect -y -- library MyLib.dll -S "Signals,SourceLink: Diagnostics" dnx dotnet-inspect -y -- library System.Text.Json \ -S "SourceLink: Availability,SourceLink: Missing Files" dnx dotnet-inspect -y -- library System.Text.Json -S "SourceLink: Integrity" dnx dotnet-inspect -y -- package System.Text.Json -S "SourceLink: Availability,SourceLink: Missing Files" ``` On `library`, category discovery is structural until `--effective` is added. On `package`, target discovery is effective by default.