The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it ingests untrusted data from the repository being reviewed and has the capability to execute shell commands. An attacker could embed malicious instructions in the Java source code, Gradle files, or the project's documentation to influence the agent's behavior during the review process. \n
Ingestion points: Reads instrumentor source code, build.gradle files, test files, and semantic convention specifications from the local environment.\n
Boundary markers: Absent. The instructions do not define clear boundaries or provide warnings to disregard embedded instructions within the processed data.\n
Capability inventory: The agent possesses read access to the local filesystem and the ability to execute shell commands via the Gradle wrapper.\n
Sanitization: No input validation or sanitization is performed on the content of the ingested files before they are interpreted or used in logic.- [COMMAND_EXECUTION]: The skill instructs the agent to run local shell commands using the project's Gradle wrapper (e.g., ./gradlew spotlessCheck and ./gradlew :instrumentation:...:test). This allows for the execution of code defined within the repository being audited, which presents a risk if the repository contains malicious build scripts or tests.- [DATA_EXFILTRATION]: The skill accesses the local directory ~/.gradle/caches/modules-2/files-2.1/ to read library sources. While this directory is typically used for legitimate dependency caching, accessing the user's home directory and tool-specific configuration folders remains a security-sensitive operation.- [EXTERNAL_DOWNLOADS]: Fetches library source jars from Maven Central (repo1.maven.org) when local cached versions are not found. This is a neutral finding as Maven Central is a well-known service for Java development artifacts.

java-code-reviewer