wxjava-api-contributor
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform verification using the command
mvn -pl <module> -am test. This is a standard development practice for running unit and integration tests in a Maven-based project.\n- [EXTERNAL_DOWNLOADS]: The instructions reference resources from thebinarywang/WxJavarepository on GitHub, including the contribution guide, wiki pages, and issue tracker. These are legitimate project-specific links used for context and documentation.\n- [PROMPT_INJECTION]: The skill is designed to ingest data from external, potentially untrusted sources such as GitHub Issues and official WeChat documentation to determine implementation requirements. This creates a surface for indirect prompt injection.\n - Ingestion points: External GitHub Issues and official documentation URLs cited in the instructions.\n
- Boundary markers: None identified; there are no specific delimiters or instructions to ignore embedded commands within the external data.\n
- Capability inventory: The skill uses
mvnfor test execution andgitfor diff checking.\n - Sanitization: No evidence of automated sanitization or filtering of the content retrieved from external sources before processing.
Audit Metadata