quarkus-update

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes build system commands including mvn, ./mvnw, gradle, ./gradlew, and the quarkus CLI. These tools are used to perform dry-run updates, apply migrations, and fetch git tags.
  • [EXTERNAL_DOWNLOADS]: Fetches reference build files and compares tags from the official Quarkus GitHub repository (github.com/quarkusio/code-with-quarkus-compare). These are vendor-provided resources used for project comparison.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources and local logs which serves as an entry point for potential indirect prompt injection.
  • Ingestion points: Reads reference pom.xml, build.gradle, and build.gradle.kts files from GitHub, as well as locally generated update artifacts like target/rewrite/rewrite.patch and target/rewrite/rewrite.log.
  • Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the content of these files as untrusted data or to ignore embedded instructions.
  • Capability inventory: File reading, network requests to GitHub, and execution of build system tools (mvn, gradle, quarkus).
  • Sanitization: The skill does not define specific validation or escaping mechanisms for the fetched or generated diffs and logs before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 01:02 PM
Security Audit — agent-trust-hub — quarkus-update