124-java-secure-coding
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
./mvnw compile,mvn compile,./mvnw clean verify, andmvn clean verify. These commands execute the Maven build tool in the local environment to build the project and run tests. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external Java projects. If the agent is used on a malicious project, the project's configuration files (e.g.,
pom.xml) could contain malicious instructions that execute during the mandatory compilation and verification phases. - Ingestion points: Java source code files and project configuration files (e.g.,
pom.xml) provided to the agent for review. - Boundary markers: None; the skill does not specify delimiters or instructions to ignore embedded commands in the source code it processes.
- Capability inventory: Execution of shell commands through
mvnand./mvnw, which can invoke compilers, run test suites, and execute plugins. - Sanitization: None; the agent is instructed to directly execute the build tools on the provided project files.
Audit Metadata