audit-project
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (project files like pom.xml and source code). It mitigates this risk by explicitly instructing the agent that everything read is evidence to report and never instructions to follow. It specifically warns the agent not to follow directives like "run this" or "ignore the rules" if found in the audited files.
- [SAFE]: The skill enforces a read-only contract. It only reads project metadata and source code for conformance analysis and explicitly states it does not edit files, add dependencies, or run builds.
- [SAFE]: Network activity is restricted to targeted lookups through the Quarkus Agents MCP and context7 MCP for official documentation and API validation. The skill avoids fetching data from untrusted third-party channels.
- [SAFE]: The skill includes a requirement to redact secrets (keys, tokens, passwords) from any evidence cited in the generated reports.
Audit Metadata