ddd4j-quarkus-web
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use npx for installing additional components within the vendor's ecosystem.
- [EXTERNAL_DOWNLOADS]: Commands like npx skills add involve downloading content from external repositories associated with the author.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes project source code and build configurations, creating a vulnerability surface where malicious instructions in those files could influence the agent. Ingestion points include local source files and POMs as described in references/source-evidence.md. Boundary markers are not specified to prevent the agent from executing instructions found in file comments. The skill has the capability to read project files and generate implementation recommendations. Sanitization of ingested file content is not explicitly mentioned.
- [DATA_EXFILTRATION]: The references/source-evidence.md file contains a hardcoded absolute local directory path referencing the author's internal development structure.
Audit Metadata