add-placeholder
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
mvn clean package -pl core -am -q. This is a standard Maven command used to verify that the code modifications compile correctly within the project. It is restricted to the specific project module. - [PROMPT_INJECTION]: The skill is designed to modify source code based on user requests, which creates a surface for indirect prompt injection.
- Ingestion points: User requests such as 'add placeholder' or 'new variable' received at runtime.
- Boundary markers: The skill includes a 'Critical' section that strictly limits modifications to a single file (
PlaceholderReplacer.java) and forbids altering existing safety guards (null-checks). - Capability inventory: The skill utilizes file system access to read and write Java source code and the capability to execute the Maven build tool.
- Sanitization: The skill enforces the use of specific Java code templates and fallback literals to maintain code integrity, though it does not explicitly sanitize the user-provided placeholder names.
Audit Metadata