migrate-spring-to-quarkus
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data (source code, build configurations, and property files) which could potentially contain instructions aimed at influencing the agent's behavior during the migration process.
- Ingestion points: Build files (pom.xml, build.gradle), configuration files (.quarkus-migration.yml), and Java source files are read into the agent's context.
- Boundary markers: No specific delimiters or "ignore instructions" warnings are applied to the ingested project content.
- Capability inventory: The skill utilizes subprocess execution for build commands (Maven, Gradle) and repository operations (Git, GitHub CLI).
- Sanitization: The skill relies on structured mapping tables and regex transformations to migrate code rather than executing raw input as code.
- [COMMAND_EXECUTION]: The skill executes standard development tools, including Maven (
./mvnw), Gradle (./gradlew), Git (git), and the GitHub CLI (gh), which are required for the stated purpose of code migration and repository management. - [SAFE]: Several security-enhancing features are implemented, such as mandatory checks for hardcoded secrets (tokens, private keys, API keys) before any git commit and the automatic exclusion of agent-specific metadata directories (e.g., .claude, .cursor, .roo) from version control to prevent data leakage.
Audit Metadata