ddd4j-cloud-stream
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted project data, such as Maven POM files, configuration files, and source code, to provide integration guidance. This creates a surface for indirect prompt injection, which is the primary intended use-case of the skill. No specific boundary markers or sanitization steps are articulated for the ingested data.
- [EXTERNAL_DOWNLOADS]: The skill documentation includes suggestions for the agent or user to install additional components using the
npx skills addcommand targeting the author's own repository (full-stack-skills/ddd4j-skills). These are legitimate vendor resources. - [COMMAND_EXECUTION]: The workflow involves running broker integration tests (Kafka, RabbitMQ, Pulsar, RocketMQ) to verify connectivity and message delivery. The skill mandates explicit user authorization for any automated commitments or releases.
Audit Metadata