problem-details-rfc9457
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides templates for standardized error handling that align with industry best practices (RFC 9457). The documentation and provided code examples (specifically in
examples/bad-exception-handler.java) explicitly warn against exposing internal stack traces and raw exception messages to API consumers, which is a key security protection against information disclosure. - [INDIRECT_PROMPT_INJECTION]: The skill defines exception handlers that interpolate exception messages directly into the
detailfield of API responses (ProblemDetail.forStatusAndDetail(status, ex.getMessage())). This creates a surface where unsanitized data from a failure point could be reflected to an agent or client. - Ingestion points:
ex.getMessage()values originating from domain-level exceptions inProblemDetailExceptionHandler.java. - Boundary markers: None identified in the prompt templates.
- Capability inventory: No risky capabilities (network, filesystem, subprocess) are present in the provided templates; they are restricted to generating HTTP response bodies.
- Sanitization: The skill effectively sanitizes generic system errors by replacing them with a static 'An unexpected error occurred' message, though domain-specific exceptions preserve their original message content.
Audit Metadata