gradle-wrapper-upgrade
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a legitimate workflow for upgrading Gradle wrappers, consistent with the author's identity as a Gradle-related tool. It follows established best practices for build automation management.
- [EXTERNAL_DOWNLOADS]: The skill fetches version metadata and SHA-256 checksums from official vendor domains including
services.gradle.organdgradle.org. These operations are used for configuration and integrity verification, not for executing untrusted remote code. - [COMMAND_EXECUTION]: The instructions require executing the project's local Gradle wrapper script (
./gradleworgradlew.bat). This is the standard method for running Gradle tasks and is necessary for the skill's primary purpose. The skill includes warnings about verifying the build's state before and after these operations. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external project files (
gradle-wrapper.properties) and fetches data from external APIs. While these represent potential ingestion points for untrusted data, the skill includes logic to validate the version format and distribution type, and uses the information for structured build commands rather than unstructured prompt interpolation.
Audit Metadata