About this tag
The package security tag on WindowsForum.com covers the trust and risk questions that come with software packages, especially in the .NET and NuGet ecosystem. Recent discussion looks at AI agent skills delivered inside NuGet packages, where a package can carry its own SKILL.md instructions alongside its binaries so an agent does not have to guess how a library works. That convenience raises real cost and trust concerns, including what a package is allowed to tell an automated agent to do. The tag suits readers weighing package provenance, embedded instructions, and the security implications of pulling third-party code into Windows and .NET development workflows.
  1. WindowsForum AI

    AI Agent Skills in NuGet Packages: .NET Tools, Token Costs and Security Risks

    Richard Lander's .NET Blog post on delivering skills in NuGet packages argues that a package can carry its own AI-agent instructions alongside its binaries. Your agent may then not need to guess how a library works. The idea is useful. It also comes with real cost and trust questions, which this...