maple-java-style
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the OpenTelemetry Java instrumentation agent from the project's official GitHub repository to enable automatic monitoring.
- [COMMAND_EXECUTION]: The skill provides instructions to execute the downloaded agent using the -javaagent JVM argument during application startup.
- [DATA_EXFILTRATION]: The skill configures the application to export telemetry data, such as traces and logs, to the vendor-controlled endpoint at ingest.maple.dev.
- [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection by incorporating environment-derived metadata into its operational templates.
- Ingestion points: Environment variables such as GITHUB_SHA and DEPLOYMENT_ENV are referenced within the code and command templates in SKILL.md.
- Boundary markers: No explicit delimiters are used to separate external data from the generated instructions.
- Capability inventory: The skill utilizes shell command execution and outbound network communication to facilitate telemetry export.
- Sanitization: There is no evidence of validation or sanitization for the environment variables before they are included in the resource attributes.
Audit Metadata