generate-async-code
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted external data sources to drive its code generation logic, creating a vulnerability surface.
- Ingestion points: The skill explicitly instructs the agent to use JIRA stories, event contracts, schemas, topics, and acceptance criteria provided in the task context (found in README.md and SKILL.md).
- Boundary markers: There are no instructions for the agent to use delimiters or ignore potentially malicious instructions embedded within the provided JIRA or schema data.
- Capability inventory: The agent has the capability to generate and modify Java source code, DTOs, mappers, and configuration files like pom.xml and application.yml.
- Sanitization: The skill does not provide any mechanisms or instructions for sanitizing, validating, or escaping the external content before it is processed by the LLM for code generation.
Audit Metadata