# Can Plugins in dotnet/skills Access External Resources?

> Learn if dotnet/skills plugins can access external resources. Discover how to manage file access and declare external MCP servers in plugin.json for validation.

- Repository: [.NET Platform/skills](https://github.com/dotnet/skills)
- Tags: how-to-guide
- Published: 2026-05-22

---

**Plugins in dotnet/skills can access external resources, but the skill-validator enforces directory restrictions for file access and requires explicit declaration of external MCP servers in [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json) to suppress validation warnings.**

The `dotnet/skills` repository provides a framework for building AI skills as self-contained plugins. Each plugin is defined by a [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json) manifest and subjected to validation checks that govern how it interacts with the host system and external services. Understanding these validation rules is essential for developers who need to integrate external APIs or local file resources into their skill implementations.

## How File System Access Is Restricted

The validation toolchain strictly limits file system access to prevent directory traversal attacks. In [`eng/skill-validator/src/Shared/PluginDiscovery.cs`](https://github.com/dotnet/skills/blob/main/eng/skill-validator/src/Shared/PluginDiscovery.cs), the **skill-validator** implements path safety checks that confine plugins to their own directory trees.

### The TryGetSafeSubdirectory Validation Logic

Lines 56-85 of [`PluginDiscovery.cs`](https://github.com/dotnet/skills/blob/main/PluginDiscovery.cs) contain the `TryGetSafeSubdirectory` method, which rejects absolute paths and any relative path containing `..` sequences that would traverse upward from the plugin root. This prevents plugins from loading arbitrary files from the host machine.

```csharp
// Safe path resolution enforced by the validator
if (PluginDiscovery.TryGetSafeSubdirectory(pluginRoot, "scripts/run.csx", out var fullPath, out var err))
{
    // fullPath is guaranteed to be inside pluginRoot
    Console.WriteLine($"Safe path resolved: {fullPath}");
}
else
{
    Console.WriteLine(err); // Rejects absolute or ".." traversals
}

```

This ensures that plugins operate within a **sandboxed file boundary**, unable to read sensitive host files or access system directories outside their bundle.

## External Dependency Declaration

While file access is restricted, network access follows different rules. The validator scans [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json) for declared **Managed Content Provider (MCP)** servers to track external dependencies.

### MCP Server Detection in Validation Tests

The test suite in [`eng/skill-validator/tests/Check/ExternalDependencyTests.cs`](https://github.com/dotnet/skills/blob/main/eng/skill-validator/tests/Check/ExternalDependencyTests.cs) (lines 255-280) demonstrates that the validator detects MCP server configurations as external dependencies. Plugins should declare these servers explicitly to avoid validation warnings about undeclared resources.

```json
{
  "name": "my-plugin",
  "version": "1.0.0",
  "description": "Demo plugin",
  "skills": [ "./skills/" ],
  "agents": [ "./agents/" ],
  "mcpServers": [ "https://my-mcp.example.com" ]
}

```

According to the source analysis, when external services are not declared in the manifest, the validator emits a warning. Proper declaration in [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json) ensures the toolchain recognizes these dependencies as intentional.

## Runtime Network Access Capabilities

The validation step does not sandbox runtime code execution. A plugin **can** instantiate `HttpClient` or other network libraries to make arbitrary HTTP requests, provided the necessary code is included in the plugin source. The validator only performs static analysis on the manifest file; it does not block the underlying networking capabilities or inspect the plugin's runtime behavior.

This means developers must self-regulate external resource access, as the framework assumes trusted code execution once validation passes. The absence of runtime restrictions allows plugins to integrate with third-party APIs, but developers must ensure all external service dependencies are documented in [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json).

## Summary

- **File access** is restricted to the plugin's own directory tree via `PluginDiscovery.TryGetSafeSubdirectory` in [`eng/skill-validator/src/Shared/PluginDiscovery.cs`](https://github.com/dotnet/skills/blob/main/eng/skill-validator/src/Shared/PluginDiscovery.cs).
- **External services** must be declared as MCP servers in [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json) to avoid validation warnings about undeclared dependencies.
- **Network calls** are not blocked by the validator; plugins can use standard .NET networking APIs like `HttpClient` without restrictions.
- The **skill-validator** performs static analysis on [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json) but does not runtime-sandbox plugin execution.

## Frequently Asked Questions

### Can a plugin read files from outside its directory?

No. The `TryGetSafeSubdirectory` method in [`eng/skill-validator/src/Shared/PluginDiscovery.cs`](https://github.com/dotnet/skills/blob/main/eng/skill-validator/src/Shared/PluginDiscovery.cs) explicitly rejects absolute paths and relative paths containing `..` traversals that would escape the plugin root folder. All file references must resolve to locations within the plugin's own directory tree, preventing access to arbitrary host system files.

### What happens if a plugin makes HTTP requests without declaring them?

The validator will emit a **warning** during the validation phase if it detects undeclared external dependencies, as demonstrated in [`ExternalDependencyTests.cs`](https://github.com/dotnet/skills/blob/main/ExternalDependencyTests.cs). However, the plugin will still function at runtime because the validator does not block network capabilities or sandbox code execution. The warning serves as a validation notice rather than a runtime barrier.

### How do I properly declare external resources in my plugin?

Add an `mcpServers` array to your [`plugin.json`](https://github.com/dotnet/skills/blob/main/plugin.json) manifest file containing the URLs of any Managed Content Provider servers your plugin consumes. This explicitly documents your external dependencies for the toolchain and suppresses validation warnings about undeclared resources.

### Does dotnet/skills prevent plugins from accessing the internet?

No. The framework does not implement network sandboxing, firewall rules, or code execution restrictions. Plugins retain full access to standard .NET networking libraries including `HttpClient`. The validation process only checks for explicit declarations of external MCP servers in the manifest file; it does not inspect or restrict the actual networking implementation within the plugin code.