400-frameworks-quarkus-create-project
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the SDKMAN (
sdk) CLI to manage and install Java and Quarkus candidates on the system. - [COMMAND_EXECUTION]: The skill executes the Quarkus CLI (
quarkus create app) to scaffold a new project and subsequently runs the Maven Wrapper (./mvnw) or Maven (mvn) to verify the project's integrity. - [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface by interpolating user-provided inputs (e.g., group ID, artifact ID, extensions) into shell commands.
- Ingestion points: User-supplied project coordinates and extension lists gathered in Step 1 of the workflow.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the prompt templates.
- Capability inventory: The agent is authorized to execute shell commands (
sdk,quarkus,mvnw) and perform filesystem writes. - Sanitization: The instructions do not define explicit sanitization or validation logic for the user-provided arguments before shell execution.
Audit Metadata