richlander dotnet-inspect: dependency signals
Use this skill to surface the observable signals about a package or library — provenance, build quality, safety surface, and supply-chain — so you can judge how much caution a dependency warrants. dotnet-inspect reports observations, not verdicts: it can give you concrete reasons for caution, not a stamp of trust.
dnx dotnet-inspect -y -- <command>
The Signals rollup
-S Signals on package or library is the one-stop view. It reports
SourceLink, determinism, trim/AOT compatibility, memory-safety metadata,
unsafe/PInvoke surface, references, TFMs, manifest/docs, license,
vulnerabilities, package age, dependency risk, and content-free summaries of
artifact-text containment and identifier confusion where applicable.
dnx dotnet-inspect -y -- package Microsoft.Extensions.AI -S Signals
dnx dotnet-inspect -y -- library System.Text.Json -S Signals
Safety and interop surface
-S @Audit expands the audit sections authored for the target. On libraries it
includes P/Invoke Methods and Audit: Identifier Confusion alongside signals,
symbols, and path evidence. Unsafe Members is a standalone library section,
not a category member; select it by name. On packages, @Audit includes
Audit: Artifact Text and Audit: Identifier Confusion. Switches is also a
separate section; select it explicitly for feature-switch and trim/AOT knobs.
(For unsafe operations inside one method, see the correctness skill; for what
switches mean across versions, see compatibility.)
dnx dotnet-inspect -y -- library MyLib.dll -S "@Audit,Switches"
dnx dotnet-inspect -y -- library MyLib.dll -S "Unsafe Members,P/Invoke Methods"
Signals stays summary-only and never repeats a concerning value. Package
Artifact text containment names the Unicode concern kinds found in
package-model fields; its focused audit lists content-free field locations and
concern kinds. Package and library Identifier confusion summarizes
non-ASCII identifiers and reserved-prefix homoglyphs; its focused audit adds
content-free locations, classifications, similarity, and code points. The
explicit library audit resolves the transitive reference closure, while the
Signals row stays bounded to the selected assembly and direct references.
dnx dotnet-inspect -y -- package MyPackage -S "Signals,Audit: Artifact Text"
dnx dotnet-inspect -y -- package MyPackage -S "Signals,Audit: Identifier Confusion"
dnx dotnet-inspect -y -- library MyLib.dll -S "Signals,Audit: Identifier Confusion"
SourceLink provenance
Distinct from fetching source (the sourcelink skill), -S @SourceLink
groups the provenance sections. Library Signals distinguishes a present
usable map from a partially usable or unusable one; SourceLink: Diagnostics
reports parse errors and rejected mappings without network access.
SourceLink: Availability reports whether documents are embedded or reachable,
SourceLink: Integrity validates their content, and SourceLink: Missing Files
reports gaps. The document-check sections also aggregate selected libraries on
package. Availability and missing-file checks may send HEAD requests for
uncached SourceLink URLs. The integrity pass fetches and hashes fetchable,
non-embedded compiler-source documents, so request these networked checks
explicitly.
dnx dotnet-inspect -y -- library System.Text.Json -D @SourceLink
dnx dotnet-inspect -y -- library System.Text.Json -D @SourceLink --effective
dnx dotnet-inspect -y -- package System.Text.Json -D @SourceLink
dnx dotnet-inspect -y -- library MyLib.dll -S "Signals,SourceLink: Diagnostics"
dnx dotnet-inspect -y -- library System.Text.Json \
-S "SourceLink: Availability,SourceLink: Missing Files"
dnx dotnet-inspect -y -- library System.Text.Json -S "SourceLink: Integrity"
dnx dotnet-inspect -y -- package System.Text.Json -S "SourceLink: Availability,SourceLink: Missing Files"
On library, category discovery is structural until --effective is added.
On package, target discovery is effective by default.