ddd4j-cloud-testing
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data from software projects, which could be used to influence agent behavior via indirect injection.
- Ingestion points: Analysis of project-specific POM files, CI test reports, and pipeline definitions as seen in SKILL.md and example audit workflows.
- Boundary markers: While the skill includes a Privacy and Security section and mandates honest reporting, it does not specify the use of strict delimiters for the data it processes.
- Capability inventory: The skill workflow includes executing unit and container-based test suites, running remote-consumer verification, and invoking version-selection tooling.
- Sanitization: The instructions explicitly require the redaction of credentials (e.g., Nacos, Redis) and real tenant data, though specific input sanitization steps for the data ingestion phase are not detailed.
- [EXTERNAL_DOWNLOADS]: The documentation references the installation of additional skills from the vendor's repository.
- Evidence: Suggestions to use 'npx skills add' for related skills (e.g., ddd4j-cloud-release) are provided in the SKILL.md file. These target the 'full-stack-skills' organization on the platform.
- [COMMAND_EXECUTION]: The defined workflows involve the execution of various development and build tools.
- Evidence: References to using npx, Maven, JDK, and Docker appear throughout the workflow and examples sections.
Audit Metadata