ddd4j-javalin-version-selection
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze project source code, root POM files, and build configurations to determine maintenance line compatibility. This task creates a surface for indirect prompt injection if the user's project files contain adversarial instructions designed to influence the agent.\n
- Ingestion points: Branch source code, root POM files (Maven model), and Maven Wrapper configurations.\n
- Boundary markers: The instructions do not explicitly provide boundary delimiters or instructions to ignore embedded prompts within the analyzed project files.\n
- Capability inventory: The skill directs the agent to perform file system reads and execute environment verification commands (
git branch,java -version,./mvnw -version).\n - Sanitization: No specific content filtering or sanitization steps are defined for the analysis phase.\n- [EXTERNAL_DOWNLOADS]: The skill documentation suggests that users can install additional capability-specific skills from the same vendor ecosystem (
full-stack-skills) using a platform-specific command line. These references target the vendor's own repository and follow established developer workflows for modular skill management.\n- [COMMAND_EXECUTION]: The workflow includes verification steps requiring the execution of local development tools (git,java,mvnw) to confirm the environment matches the selected version contract. These are standard diagnostic operations for the intended use case.
Audit Metadata