eliteforge-java-service-generator
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution to scaffold and initialize Java projects.
- The file
scripts/generate.pyinvokesmvn archetype:generateusingsubprocess.run(). This is implemented safely by passing arguments as a list rather than a shell string, and the script validates core identifiers (company, product, service) against a strict kebab-case regex to prevent injection. - The
SKILL.mdfile instructs the agent to executemake installwithin the directory generated by the Maven process. - [EXTERNAL_DOWNLOADS]: The skill triggers remote content downloads as part of its primary function.
- The Maven archetype generation process connects to remote repositories to fetch the
cn.cisdigital.generator.archtypetemplate. - [PROMPT_INJECTION]: The skill implements defensive instructions to prevent accidental activation.
- Both
SKILL.mdandagents/openai.yamlcontain explicit "trigger thresholds," instructing the agent to only use the skill if the user explicitly confirms the project follows the 'EliteForge specification'.
Audit Metadata