gradle-build-performance
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user or agent to execute local shell commands using the Gradle wrapper (
./gradlew) to generate build reports and scans. This is standard behavior for the intended purpose of build optimization. - [DATA_EXFILTRATION]: The skill promotes the use of the
--scanflag, which by default uploads build data (environment details, dependencies, project structure) to Gradle's public scan service atscans.gradle.com. While this is a standard feature of the Gradle ecosystem, users should be aware that it involves transferring build metadata to an external service. - [REMOTE_CODE_EXECUTION]: The instructions recommend applying third-party Gradle plugins, such as
com.gradle.develocity. In the Gradle ecosystem, plugins execute code during the build process to provide functionality, which is a standard but inherently high-privilege operation within the build environment.
Audit Metadata