ddd4j-boot-version-selection
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run local environment commands such as
git branch,java -version, and./mvnw -versionto gather project constraints. It also includes a verification step involving./mvnw verifyto ensure the project builds correctly with the selected maintenance line. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of related tools using the
npx skills addcommand and involves network operations to verify that artifacts are published and consumable from a private repository using Maven's clean cache flag (-U). - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests and processes untrusted data from the user's project environment to provide compatibility advice.
- Ingestion points: Project metadata including branch names, POM files, and the output of environment probe commands.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when reading project configuration files.
- Capability inventory: The skill has the ability to read project files, execute shell commands (git, java, mvnw), and perform network operations via build tools.
- Sanitization: There is no evidence of explicit sanitization or filtering applied to the content of the analyzed project files or command outputs.
Audit Metadata