You can actually put a full commit ID in the Tag field (which actually supports any refname)... I'll have someone put a note in to change that in the operation.

To downlad a package, you'd need to use the feed-specific API (NuGet, npm, etc). The SDK is really only designed for building extensions.

You can use the Execute-LegacyAction Operation to do this; it inputs the XML-based configuration of the action. The easiest way to get this XML is to create a legacy plan with the desired action, then convert to OtterScript.

I was refering to Strong-Naming. I was using a passworded file .pfx and therefore causing issues, I moved to a .snk file (not password protected) and it's working correctly now.