problem-details-rfc9457

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides templates for standardized error handling that align with industry best practices (RFC 9457). The documentation and provided code examples (specifically in examples/bad-exception-handler.java) explicitly warn against exposing internal stack traces and raw exception messages to API consumers, which is a key security protection against information disclosure.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines exception handlers that interpolate exception messages directly into the detail field of API responses (ProblemDetail.forStatusAndDetail(status, ex.getMessage())). This creates a surface where unsanitized data from a failure point could be reflected to an agent or client.
  • Ingestion points: ex.getMessage() values originating from domain-level exceptions in ProblemDetailExceptionHandler.java.
  • Boundary markers: None identified in the prompt templates.
  • Capability inventory: No risky capabilities (network, filesystem, subprocess) are present in the provided templates; they are restricted to generating HTTP response bodies.
  • Sanitization: The skill effectively sanitizes generic system errors by replacing them with a static 'An unexpected error occurred' message, though domain-specific exceptions preserve their original message content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 06:39 AM
Security Audit — agent-trust-hub — problem-details-rfc9457