quarkus-update
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes build system commands including
mvn,./mvnw,gradle,./gradlew, and thequarkusCLI. These tools are used to perform dry-run updates, apply migrations, and fetch git tags. - [EXTERNAL_DOWNLOADS]: Fetches reference build files and compares tags from the official Quarkus GitHub repository (
github.com/quarkusio/code-with-quarkus-compare). These are vendor-provided resources used for project comparison. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources and local logs which serves as an entry point for potential indirect prompt injection.
- Ingestion points: Reads reference
pom.xml,build.gradle, andbuild.gradle.ktsfiles from GitHub, as well as locally generated update artifacts liketarget/rewrite/rewrite.patchandtarget/rewrite/rewrite.log. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the content of these files as untrusted data or to ignore embedded instructions.
- Capability inventory: File reading, network requests to GitHub, and execution of build system tools (
mvn,gradle,quarkus). - Sanitization: The skill does not define specific validation or escaping mechanisms for the fetched or generated diffs and logs before they are processed by the agent.
Audit Metadata