112-java-maven-plugins
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a legitimate framework for enhancing Java project configurations through a step-by-step interactive process that preserves existing user settings.
- [COMMAND_EXECUTION]: The skill utilizes standard build automation commands such as
mvn validate,./mvnw verify, andjava -jar(for benchmark execution). These actions are consistent with the skill's primary purpose as a development utility. - [REMOTE_CODE_EXECUTION]: The skill configures Maven to retrieve and execute widely recognized industry-standard plugins (e.g., JaCoCo, SpotBugs, OWASP Dependency Check) from established public repositories.
- [DATA_EXFILTRATION]: The skill supports SonarCloud and SonarQube integration, which involves transmitting project analysis data to those external services. This is an intended feature of the skill.
- [PROMPT_INJECTION]: The skill processes user-supplied values (e.g., project keys, version numbers) and interpolates them into
pom.xmlfiles. This represents an indirect prompt injection surface if the input source is untrusted, though the risk is minimal in a developer-driven environment. - Ingestion points: User responses to configuration questions defined in
SKILL.md. - Boundary markers: None present in the XML templates.
- Capability inventory: File system write access to project configuration files and execution of shell-based build commands.
- Sanitization: No explicit sanitization or input validation was detected.
Audit Metadata