build-project
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to perform project builds and manage dependencies, including
opentaint compile,opentaint project,./gradlew,mvn, andgit submodule update. These are standard operations required for software compilation and environment setup. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of external components and dependencies using standard tools like Git, Maven, and Gradle. These operations are directed at official registries or project-configured repositories.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external project data, creating a potential surface for indirect prompt injection if target build files (e.g.,
build.gradle,pom.xml) contain malicious logic. - Ingestion points: Project configuration files and source code located in the
project-rootprovided at runtime. - Boundary markers: None; the skill follows the project's native build definitions without explicit isolation or ignore-markers for embedded instructions.
- Capability inventory: Shell execution capabilities via the
opentaintbinary and language-specific build wrappers. - Sanitization: No pre-execution sanitization of the target project's build scripts is performed, as the skill is intended to execute the project's own build workflow.
Audit Metadata