gradle-build-performance
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Provides instructions for using the Gradle wrapper (
./gradlew) to generate build scans and performance profiles. These are routine development tasks performed within the local project environment. - [EXTERNAL_DOWNLOADS]: Recommends the adoption of trusted and well-known libraries and plugins, such as Google's Hilt/KSP and Gradle's Develocity, for build efficiency and analytics.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze build output (scans, logs) and suggest configuration changes to files like
gradle.propertiesorsettings.gradle.kts. This pattern creates an attack surface where an attacker providing a malicious build artifact could influence the agent to suggest unsafe project modifications. (Evidence: Ingestion points include build scans and timing logs in SKILL.md; capability inventory includes modifying sensitive configuration files and executing shell commands; boundary markers are absent; and there are no explicit sanitization steps for build artifact data).
Audit Metadata