ddd4j-quarkus-mq
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill includes explicit security instructions in the 'Privacy and Security' section, mandating that the agent never outputs tokens, OIDC secrets, or database/broker credentials, and utilizes de-identified placeholders for examples.
- [SAFE]: References to external skill installation use the standard platform command (
npx skills add) and point to the same verified vendor (full-stack-skills), representing expected cross-skill documentation. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves analyzing project source code, POM files, and CI logs. This creates a surface where an attacker could embed malicious instructions within the project being audited to influence the agent. However, the skill does not define autonomous write or network tools that would enable significant exploitation of this surface.
- [DATA_EXPOSURE]: The file
references/source-evidence.mdcontains a hardcoded local file path (/Users/wandl/workspaces/...). This appears to be a configuration artifact from the developer's environment used to orient the agent to the 'source of truth' for the ddd4j project, rather than a malicious attempt to exfiltrate data.
Audit Metadata