jakarta-java25-migration
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses Maven to download and execute the OpenRewrite plugin (
rewrite-maven-plugin) and associated migration recipes (rewrite-migrate-java) from public repositories like Maven Central. This is a standard practice for automated code refactoring and uses well-known, established tools. - [COMMAND_EXECUTION]: The skill includes several Bash commands to automate project structure detection, create migration copies of the application, and run the Maven transformation commands. These scripts operate within the local project environment and are intended for legitimate migration workflows.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the user's project files, such as
pom.xmland Java source files, to detect patterns requiring migration. While processing external data is an attack surface, the transformation logic is performed by standard refactoring tools and the agent's interpretation of the project structure. - Ingestion points: Project configuration files (
pom.xml) and Java source files (*.java). - Boundary markers: The skill uses specific Grep patterns and OpenRewrite recipes to scope the transformation.
- Capability inventory: The skill has access to file system tools (
Read,Edit,Write,Bash,Glob) to perform the migration. - Sanitization: The migration is performed using structured tools like Maven/OpenRewrite rather than direct execution of unsanitized content found within the project files.
Audit Metadata