java-add-graalvm-native-image-support
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes project files such as
pom.xmlandbuild.gradleto detect frameworks and configurations. While these files are external inputs, the skill uses them for standard build configuration and explicitly requires user approval for significant changes like dependency upgrades or CI modifications. - Ingestion points: Project build files including
pom.xml,build.gradle,build.gradle.kts, andapplication.properties(detected inSKILL.mdandreferences/spring-boot.md). - Boundary markers: None explicitly defined for file ingestion.
- Capability inventory: Execution of build tool wrappers (
./mvnw,./gradlew), compiler tools (native-image), and JDK utilities (java). - Sanitization: The skill does not specify sanitization for project file content, but its logic is restricted to standard build and AOT (Ahead-of-Time) processing tasks.
- [EXTERNAL_DOWNLOADS]: The skill refers to official and well-known development resources for tool installation and metadata.
- Evidence: Mentions using SDKMAN, official vendor downloads, and the
graalvm/setup-graalvmGitHub Action for toolchain setup (SKILL.md). - Evidence: References the official GraalVM reachability metadata repository on GitHub (
references/reachability-metadata.md). - [COMMAND_EXECUTION]: The skill instructs the agent to run standard build tool commands and the GraalVM tracing agent to generate configuration.
- Evidence: Commands include
./mvnw -Pnative native:compile,./gradlew nativeCompile, andjava -agentlib:native-image-agent(SKILL.md,references/reachability-metadata.md). These are standard operations for Java native image development.
Audit Metadata