110-java-maven-best-practices
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run standard Maven lifecycle commands, including
mvn validate,./mvnw validate, and./mvnw clean verify. These commands are used to check the structural integrity of the project and verify the build process, which is the primary purpose of the skill. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests and processes data from the user's project files.
- Ingestion points: The agent is instructed to read
pom.xmlfiles from the root directory and all child modules. - Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between project data and its own system instructions.
- Capability inventory: The agent can execute shell commands via the Maven binary and its wrapper script.
- Sanitization: The skill does not provide instructions to sanitize or validate the content of the POM files before they are processed.
- [SAFE]: No evidence of malicious code, obfuscation, hardcoded credentials, or unauthorized network operations was found in the skill's instructions or supporting documentation.
Audit Metadata