ddd4j-quarkus-runtime
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing additional components using
npx skills add full-stack-skills/ddd4j-skills. These resources are provided by the author and are considered part of the expected ecosystem. - [METADATA_POISONING]: The reference document
references/source-evidence.mdcontains a hardcoded local file path (/Users/wandl/workspaces/workspace-ddd4j/workspace-ddd4j-boot/ddd4j-quarkus) which leaks information about the developer's environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes project source code and configuration files, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: Project source code,
runtime-quarkusfiles, and Maven POM files. - Boundary markers: The skill lacks explicit instructions for using delimiters or boundary markers when the agent processes external data.
- Capability inventory: The skill provides code generation and review capabilities, but does not directly execute system commands.
- Sanitization: No input validation or sanitization steps are documented for analyzed project files.
Audit Metadata