Can Plugins in dotnet/skills Access External Resources?

Plugins in dotnet/skills can access external resources, but the skill-validator enforces directory restrictions for file access and requires explicit declaration of external MCP servers in plugin.json to suppress validation warnings.

The dotnet/skills repository provides a framework for building AI skills as self-contained plugins. Each plugin is defined by a plugin.json manifest and subjected to validation checks that govern how it interacts with the host system and external services. Understanding these validation rules is essential for developers who need to integrate external APIs or local file resources into their skill implementations.

How File System Access Is Restricted

The validation toolchain strictly limits file system access to prevent directory traversal attacks. In eng/skill-validator/src/Shared/PluginDiscovery.cs, the skill-validator implements path safety checks that confine plugins to their own directory trees.

The TryGetSafeSubdirectory Validation Logic

Lines 56-85 of PluginDiscovery.cs contain the TryGetSafeSubdirectory method, which rejects absolute paths and any relative path containing .. sequences that would traverse upward from the plugin root. This prevents plugins from loading arbitrary files from the host machine.

// Safe path resolution enforced by the validator
if (PluginDiscovery.TryGetSafeSubdirectory(pluginRoot, "scripts/run.csx", out var fullPath, out var err))
{
    // fullPath is guaranteed to be inside pluginRoot
    Console.WriteLine($"Safe path resolved: {fullPath}");
}
else
{
    Console.WriteLine(err); // Rejects absolute or ".." traversals
}

This ensures that plugins operate within a sandboxed file boundary, unable to read sensitive host files or access system directories outside their bundle.

External Dependency Declaration

While file access is restricted, network access follows different rules. The validator scans plugin.json for declared Managed Content Provider (MCP) servers to track external dependencies.

MCP Server Detection in Validation Tests

The test suite in eng/skill-validator/tests/Check/ExternalDependencyTests.cs (lines 255-280) demonstrates that the validator detects MCP server configurations as external dependencies. Plugins should declare these servers explicitly to avoid validation warnings about undeclared resources.

{
  "name": "my-plugin",
  "version": "1.0.0",
  "description": "Demo plugin",
  "skills": [ "./skills/" ],
  "agents": [ "./agents/" ],
  "mcpServers": [ "https://my-mcp.example.com" ]
}

According to the source analysis, when external services are not declared in the manifest, the validator emits a warning. Proper declaration in plugin.json ensures the toolchain recognizes these dependencies as intentional.

Runtime Network Access Capabilities

The validation step does not sandbox runtime code execution. A plugin can instantiate HttpClient or other network libraries to make arbitrary HTTP requests, provided the necessary code is included in the plugin source. The validator only performs static analysis on the manifest file; it does not block the underlying networking capabilities or inspect the plugin's runtime behavior.

This means developers must self-regulate external resource access, as the framework assumes trusted code execution once validation passes. The absence of runtime restrictions allows plugins to integrate with third-party APIs, but developers must ensure all external service dependencies are documented in plugin.json.

Summary

• File access is restricted to the plugin's own directory tree via PluginDiscovery.TryGetSafeSubdirectory in eng/skill-validator/src/Shared/PluginDiscovery.cs.
• External services must be declared as MCP servers in plugin.json to avoid validation warnings about undeclared dependencies.
• Network calls are not blocked by the validator; plugins can use standard .NET networking APIs like HttpClient without restrictions.
• The skill-validator performs static analysis on plugin.json but does not runtime-sandbox plugin execution.

Frequently Asked Questions

Can a plugin read files from outside its directory?

No. The TryGetSafeSubdirectory method in eng/skill-validator/src/Shared/PluginDiscovery.cs explicitly rejects absolute paths and relative paths containing .. traversals that would escape the plugin root folder. All file references must resolve to locations within the plugin's own directory tree, preventing access to arbitrary host system files.

What happens if a plugin makes HTTP requests without declaring them?

The validator will emit a warning during the validation phase if it detects undeclared external dependencies, as demonstrated in ExternalDependencyTests.cs. However, the plugin will still function at runtime because the validator does not block network capabilities or sandbox code execution. The warning serves as a validation notice rather than a runtime barrier.

How do I properly declare external resources in my plugin?

Add an mcpServers array to your plugin.json manifest file containing the URLs of any Managed Content Provider servers your plugin consumes. This explicitly documents your external dependencies for the toolchain and suppresses validation warnings about undeclared resources.

Does dotnet/skills prevent plugins from accessing the internet?

No. The framework does not implement network sandboxing, firewall rules, or code execution restrictions. Plugins retain full access to standard .NET networking libraries including HttpClient. The validation process only checks for explicit declarations of external MCP servers in the manifest file; it does not inspect or restrict the actual networking implementation within the plugin code.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}