112-java-maven-plugins
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Maven Wrapper (
./mvnw) andmvncommands to validate the project's state, install the wrapper, and verify plugin configurations (e.g.,mvn wrapper:wrapper,mvn validate). These operations are standard for Java development and are triggered transparently as part of the documented workflow. - [EXTERNAL_DOWNLOADS]: The skill configures Maven to download plugins from the central repository and integrates the OWASP Dependency Check, which fetches vulnerability data from the National Vulnerability Database (NVD). It also facilitates the installation of the Maven Wrapper from official sources. These activities target well-known and trusted services essential for the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project data by scanning
pom.xmland properties files to adapt its recommendations. It also interpolates user-provided values (e.g., Sonar keys, container image names) into XML configurations. The risk is minimized by using a structured, question-driven process and adhering to standard XML schemas. - [DYNAMIC_EXECUTION]: The skill generates project-specific files from templates, such as a JMH benchmark class (
FibonacciBenchmark.java) and PMD ruleset files. It then guides the user to compile and execute these generated components as part of the build and testing lifecycle. This is a legitimate functional requirement for benchmarking and static analysis.
Audit Metadata