ddd4j-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes project source code and configuration files, creating a vulnerability surface where malicious code comments or strings could influence agent behavior.\n
- Ingestion points: Reads local Java source code, Git repository structure, call graphs, and Maven POM files as specified in the 'Workflow' sections of SKILL.md and references/workflow.md.\n
- Boundary markers: Absent; the skill instructions do not specify any delimiters or instructions to disregard potential prompt injections within the ingested code files.\n
- Capability inventory: The skill is restricted to analysis and reporting. It lacks capabilities for file system modification (write), network egress, or system configuration changes.\n
- Sanitization: Absent; no sanitization or filtering of input data (such as code comments) is mentioned.\n- [METADATA_POISONING]: The skill includes self-authoritative claims regarding its own safety and privacy protocols.\n
- Evidence: The 'Privacy and Security' section in SKILL.md explicitly claims the skill does not access, collect, or transmit user data. These claims (including the Chinese translation) attempt to establish a 'safe' verdict within the skill's own content, which is a deceptive metadata pattern (Category 8e: Self-referential).
Audit Metadata