ddd4j-quarkus-testing
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The file references/source-evidence.md contains a hardcoded absolute path (/Users/wandl/workspaces/workspace-ddd4j/workspace-ddd4j-boot/ddd4j-quarkus) revealing the original author's local directory structure. This is information exposure of the development environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as source code, POM files, and test evidence. (1) Ingestion points: Analyzed project files and CI evidence. (2) Boundary markers: None specified. (3) Capability inventory: Information analysis and reporting. (4) Sanitization: None specified. The skill mitigates this by instructing the agent to never output secrets and to maintain evidence integrity.
- [COMMAND_EXECUTION]: The skill documentation describes the use of npx skills add to install related tools. This involves command execution via the Node.js package runner.
- [EXTERNAL_DOWNLOADS]: The use of npx involves downloading external packages. The packages belong to the vendor full-stack-skills, making them legitimate vendor resources.
Audit Metadata