build-tools-bump-gradle-in-tests
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill takes a Gradle version string provided by the user and writes it into multiple source files including
TestVersions.kt,build.gradle.kts, andGradleCompatibilityIT.kt. - Ingestion points: User-supplied
MAJOR.MINOR.PATCHversion string. - Boundary markers: The instructions require the agent to confirm the version with the user and reject input that does not follow the expected format or is lower than the current supported version.
- Capability inventory: The skill utilizes MCP tools to read and replace text in project files and executes
./gradlewvia the shell for test verification. - Sanitization: Input is checked against expected version patterns, and dots are replaced with underscores for specific build task names.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the project's local Gradle wrapper (
./gradlew) to run integration tests. This is a standard and necessary operation for the stated purpose of updating build dependencies.
Audit Metadata