cve-remediation
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- Command Execution: The skill utilizes standard project build tools and wrappers, such as Maven (
./mvnw), Gradle (./gradlew), and the .NET CLI, to apply security patches and verify build integrity. These commands are essential for the skill's primary function of dependency remediation and represent standard developer operations. - Indirect Prompt Injection: This skill ingests and parses JSON findings from external vulnerability reports (
cve-report-N.json). This process involves the following security considerations: - Ingestion points: Vulnerability data is read from JSON reports generated by tools or fallback scanning in
SKILL.md(Step 3). - Boundary markers: Explicit delimiters or specific warnings to ignore embedded instructions within the ingested JSON content are not defined.
- Capability inventory: The skill has the capability to execute shell commands and modify manifest files, as detailed in
SKILL.mdSteps 4 and 6. - Sanitization: The instructions do not specify a validation or sanitization step for the text within vulnerability explanations before the agent processes them.
Audit Metadata