maven-dependency-audit
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to execute various Maven lifecycle commands for dependency management and auditing. These commands interact with the local file system to read and modify pom.xml files and interact with external Maven repositories to fetch dependency information. \n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external project files and tool outputs, creating a surface for indirect prompt injection. \n
- Ingestion points: Untrusted data enters the agent context through pom.xml files and the standard output of Maven commands such as mvn dependency:tree and mvn versions:display-dependency-updates as described in SKILL.md. \n
- Boundary markers: The skill does not implement delimiters or explicit instructions for the agent to ignore potentially malicious content embedded in the audited data. \n
- Capability inventory: The skill utilizes the mvn CLI, which has capabilities for file system modification (pom.xml updates) and network communication (repository synchronization). \n
- Sanitization: No specific sanitization, validation, or filtering of external content is specified before the agent analyzes the data.
Audit Metadata