Tighten known-domains allowlist

[danmoseley]

Tighten known-domains allowlist

Supersedes #495, recreated from an upstream branch so infra-related checks run with the expected permissions.

Narrows the known-domains allowlist to reduce the surface area of permitted external links in skill content.

Changes

known-domains.txt

• aka.ms (broad) -> aka.ms/dotnet-trace, aka.ms/perfcollect
• nuget.org (broad) -> api.nuget.org, nuget.org/account/trustedpublishing
• npmjs.com/package/@modelcontextprotocol (broad, nonexistent URL) -> npmjs.com/package/@modelcontextprotocol/inspector/v/0.21.1
• Removed nugettest.org, fluentassertions.com, and speedscope.app

Skill content fixes

• mcp-csharp-debug/SKILL.md: Pin MCP Inspector link to v0.21.1
• mcp-csharp-test/SKILL.md: Remove FluentAssertions link
• mcp-csharp-publish/references/nuget-packaging.md: Remove the NuGet test-environment push example
• dotnet-trace-collect.md: Remove speedscope.app hyperlink, keep tool name

[leslierichardson95]

Still looks good!

[Copilot]

Pull request overview

This PR tightens the repository’s external-link allowlist (eng/known-domains.txt) to reduce the set of permitted outbound references in skill content, and updates affected skill documentation to comply with the narrowed allowlist (plus a small CODEOWNERS update for MCP C# skills/tests).

Changes:

• Narrow eng/known-domains.txt entries to path-scoped allowlist items (e.g., aka.ms/dotnet-trace, nuget.org/account/trustedpublishing) and remove no-longer-needed community domains.
• Update skill/reference markdown files to remove or pin external links so they remain compliant (e.g., pin npmjs MCP Inspector to a specific version, remove FluentAssertions and Speedscope hyperlinks, remove NuGet test push example).
• Update CODEOWNERS entries for the MCP C# skill/test directories.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
plugins/dotnet-diag/skills/dotnet-trace-collect/references/dotnet-trace-collect.md	Removes the speedscope.app hyperlink while preserving the tool reference in the output formats table.
plugins/dotnet-ai/skills/mcp-csharp-test/SKILL.md	Removes the FluentAssertions external link from “More Info”.
plugins/dotnet-ai/skills/mcp-csharp-publish/references/nuget-packaging.md	Removes the NuGet test-environment push example (nugettest.org).
plugins/dotnet-ai/skills/mcp-csharp-debug/SKILL.md	Pins the MCP Inspector npmjs link to a specific versioned page.
eng/known-domains.txt	Tightens allowlist entries (path-scoped) and removes unneeded domains to reduce external-link surface area.
.github/CODEOWNERS	Updates ownership for MCP C# skill/test directories.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[danmoseley]

/evaluate

[github-actions]

Skill Validation Results

Skill	Scenario	Quality	Skills Loaded	Overfit	Verdict
dotnet-trace-collect	High CPU in Kubernetes on Linux (.NET 8)	3.7/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅ [1]
dotnet-trace-collect	.NET Framework on Windows without admin privileges	2.7/5 → 4.7/5 🟢	✅ dotnet-trace-collect; tools: skill	✅ 0.10	✅ [2]
dotnet-trace-collect	.NET 10 on Linux with root access and native call stacks	1.0/5 → 3.3/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅
dotnet-trace-collect	Memory leak on Linux (.NET 8)	3.0/5 → 3.0/5	✅ dotnet-trace-collect; tools: skill, report_intent, view / ✅ dotnet-trace-collect; tools: skill	✅ 0.10	✅
dotnet-trace-collect	Slow requests on Windows with PerfView	3.7/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view / ✅ dotnet-trace-collect; tools: skill	✅ 0.10	✅
dotnet-trace-collect	Excessive GC on Linux (.NET 8)	4.3/5 → 4.3/5	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	❌ [3]
dotnet-trace-collect	Hang or deadlock diagnosis on Linux	3.0/5 → 3.0/5 ⏰	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅ [4]
dotnet-trace-collect	Windows container high CPU with PerfView	1.3/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅
dotnet-trace-collect	Long-running intermittent issue with PerfView triggers	2.7/5 → 4.7/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅ [5]
dotnet-trace-collect	Linux pre-.NET 10 needing native call stacks	2.0/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅
dotnet-trace-collect	Windows modern .NET with admin high CPU	2.0/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅
dotnet-trace-collect	Memory leak on .NET Framework Windows	3.3/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅ [6]
dotnet-trace-collect	Kubernetes with console access prefers console tools	4.3/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	❌ [7]
dotnet-trace-collect	Container installation without .NET SDK	3.3/5 → 4.7/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅
dotnet-trace-collect	HTTP 500s from downstream service on Linux (.NET 8)	4.0/5 → 5.0/5 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅
dotnet-trace-collect	Networking timeouts on Windows with admin (.NET 8)	2.0/5 → 2.3/5 ⏰ 🟢	✅ dotnet-trace-collect; tools: report_intent, skill, view / ✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	❌ [8]
dotnet-trace-collect	Assembly loading failure on Linux (.NET 8)	3.0/5 → 3.7/5 ⏰ 🟢	✅ dotnet-trace-collect; tools: skill, report_intent, view	✅ 0.10	✅ [9]
mcp-csharp-test	Write unit and integration tests for an MCP server	2.0/5 → 4.0/5 🟢	✅ mcp-csharp-test; tools: skill, report_intent, view	✅ 0.15	✅
mcp-csharp-test	Test an HTTP MCP server with WebApplicationFactory	3.3/5 → 5.0/5 🟢	✅ mcp-csharp-test; tools: report_intent, skill, view / ✅ mcp-csharp-test; tools: skill, report_intent, view	✅ 0.15	❌ [10]
mcp-csharp-test	Create evaluations for an MCP server	2.3/5 ⏰ → 5.0/5 🟢	✅ mcp-csharp-test; tools: skill	✅ 0.15	✅ [11]
mcp-csharp-debug	Debug an MCP server with MCP Inspector	4.3/5 → 4.0/5 🔴	✅ mcp-csharp-debug; tools: report_intent, skill	✅ 0.16	❌
mcp-csharp-debug	Configure VS Code to use an MCP server	3.7/5 → 4.7/5 🟢	✅ mcp-csharp-debug; tools: skill, view, glob, report_intent, bash	✅ 0.16	✅
mcp-csharp-debug	Debug a failing MCP server tool	4.3/5 → 4.0/5 🔴	✅ mcp-csharp-debug; tools: skill, report_intent / ✅ mcp-csharp-debug; tools: skill	✅ 0.16	❌ [12]
mcp-csharp-publish	Publish an MCP server as a NuGet tool package	3.0/5 → 4.0/5 🟢	✅ mcp-csharp-publish; tools: skill, glob	✅ 0.15	✅
mcp-csharp-publish	Deploy an HTTP MCP server to Azure Container Apps	3.3/5 → 5.0/5 🟢	✅ mcp-csharp-publish; tools: skill, report_intent, view	✅ 0.15	✅
mcp-csharp-publish	Publish to the MCP Registry	1.0/5 → 4.0/5 🟢	✅ mcp-csharp-publish; tools: report_intent, skill / ✅ mcp-csharp-publish; tools: skill, report_intent, view	✅ 0.15	✅

[1] ⚠️ High run-to-run variance (CV=8.39) — consider re-running with --runs 5
[2] ⚠️ High run-to-run variance (CV=0.62) — consider re-running with --runs 5
[3] ⚠️ High run-to-run variance (CV=72.05) — consider re-running with --runs 5. (Isolated) Quality unchanged but weighted score is -28.4% due to: judgment, quality, tokens (12221 → 51976), tool calls (0 → 3), time (23.7s → 49.3s)
[4] ⚠️ High run-to-run variance (CV=2.22) — consider re-running with --runs 5
[5] ⚠️ High run-to-run variance (CV=6.20) — consider re-running with --runs 5
[6] ⚠️ High run-to-run variance (CV=90.88) — consider re-running with --runs 5
[7] ⚠️ High run-to-run variance (CV=1.59) — consider re-running with --runs 5. (Isolated) Quality improved but weighted score is -3.3% due to: quality, tokens (12013 → 54741), tool calls (0 → 3), time (15.9s → 48.0s)
[8] ⚠️ High run-to-run variance (CV=5.17) — consider re-running with --runs 5. (Isolated) Quality improved but weighted score is -40.0% due to: judgment, quality, tokens (12369 → 29328), errors (0 → 1), tool calls (0 → 2), time (17.8s → 50.4s)
[9] ⚠️ High run-to-run variance (CV=24.40) — consider re-running with --runs 5
[10] ⚠️ High run-to-run variance (CV=7.27) — consider re-running with --runs 5. (Isolated) Quality improved but weighted score is -6.0% due to: tokens (12793 → 45356), tool calls (0 → 4), time (22.4s → 62.9s)
[11] ⚠️ High run-to-run variance (CV=0.76) — consider re-running with --runs 5
[12] ⚠️ High run-to-run variance (CV=2.74) — consider re-running with --runs 5

⏰ timeout — run(s) hit the (60s, 120s) scenario timeout limit; scoring may be impacted by aborting model execution before it could produce its full output (increase via timeout in eval.yaml)

Model: claude-opus-4.6 | Judge: claude-opus-4.6

🔍 Full Results - additional metrics and failure investigation steps