ddd4j-javalin-auth
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill is primarily instructional, focusing on the correct and secure implementation of authentication and authorization within a specific Java framework (ddd4j-javalin).
- [DATA_EXPOSURE]: The skill includes explicit instructions and safety rules to prevent the exposure of sensitive data. It mandates the redaction of tokens, cookies, OIDC secrets, and database credentials from all output and logs.
- [INDIRECT_PROMPT_INJECTION]: While the skill defines workflows for processing authentication data, it addresses the attack surface by requiring sanitization (redaction) and lifecycle cleanup. It specifically warns against 'Subject leakage' where a thread might inherit credentials from a previous request, providing clear remediation steps.
- [EXTERNAL_DOWNLOADS]: The skill mentions other related skills (e.g.,
ddd4j-javalin-web) and providesnpxcommands for the user to install them. These references are directed at the author's own verified ecosystem ('full-stack-skills') and serve as legitimate project scaffolding instructions rather than hidden or malicious downloads.
Audit Metadata