124-java-secure-coding
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands including './mvnw compile', 'mvn compile', and 'mvn clean verify'. These operations are standard in Java development workflows for validating code integrity and ensuring that security refactors do not break project functionality.
- [PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided Java source code, which constitutes an indirect prompt injection surface. A malicious user could provide code containing comments or strings designed to misdirect the agent's behavior during the review process. (1) Ingestion points: Java source files provided for security review. (2) Boundary markers: No specific delimiters or safety wrappers are defined for the code-reading steps. (3) Capability inventory: Access to Maven shell commands via the terminal. (4) Sanitization: The skill does not specify any sanitization of the input code before processing. This is a low-risk surface inherent to the skill's primary purpose.
- [CREDENTIALS_UNSAFE]: The reference document 'references/124-java-secure-coding.md' contains illustrative examples of hardcoded credentials, such as dummy database passwords. These are explicitly labeled as 'AVOID' or 'Bad example' for educational purposes to demonstrate insecure coding habits and do not pose a direct security risk.
Audit Metadata