java-migration

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is a standard technical reference for Java developers. It contains no evidence of malicious intent, prompt injection, or data exfiltration. All provided code snippets and commands are relevant to the stated goal of project migration.
  • [EXTERNAL_DOWNLOADS]: The skill refers to the OpenRewrite project to automate migrations via Maven and Gradle. This involves downloading and executing standard, well-known development plugins from public registries, which is a common and accepted practice in software engineering.
  • [COMMAND_EXECUTION]: The skill uses local commands such as grep to identify deprecated APIs and mvn compile to verify project health. These operations are restricted to the local development environment and are appropriate for the migration use case.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data in the form of Java source code and build configuration files, which represents a potential injection surface.
  • Ingestion points: Project source code files (.java) and build descriptors (pom.xml, build.gradle) in the skill's file-system context.
  • Boundary markers: No specific delimiters or warnings for the agent to ignore instructions embedded in code comments are present.
  • Capability inventory: File system access, Maven execution, and string searching via grep.
  • Sanitization: No explicit sanitization or filtering of the ingested code is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 12:17 AM