180-java-observability-logging
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides security-conscious guidance for Java logging, including detailed examples of how to mask sensitive data like credit card numbers and SSNs, and explicitly warns against logging credentials or system internals.
- [COMMAND_EXECUTION]: The skill uses standard Maven commands (
mvn compile,mvn clean verify) to validate project state and the impact of logging changes. These are routine development tasks. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes user-provided Java code and executes shell commands. Ingestion points: User-supplied Java source code. Boundary markers: Absent. Capability inventory:
mvnsubprocess calls. Sanitization: Absent. - [CREDENTIALS_UNSAFE]: A mock password (
password=secret123) is present in a 'Bad example' block labeled 'AVOID' for educational purposes to demonstrate insecure practices; it does not represent an actual security risk.
Audit Metadata