java-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads project build configuration files (e.g., pom.xml, build.gradle, CI files) to detect current Java versions. This creates a surface for indirect prompt injection where malicious content embedded in build files could attempt to influence the agent. However, the skill's logic is focused on version detection and applying static per-version guides.
- Ingestion points: pom.xml, build.gradle, and various CI configuration files.
- Boundary markers: None specified in the instructions.
- Capability inventory: File system reads and execution of local build wrappers.
- Sanitization: Not explicitly implemented for build file content.
- [COMMAND_EXECUTION]: The skill instructs the agent to run project build commands like './mvnw verify' or './gradlew build' to validate the upgrade. It also references external tools such as the 'modernize-java' plugin from Microsoft and the Copilot CLI from GitHub. These are established tools provided by trusted organizations and are standard for the intended task.
Audit Metadata