skills/seqra/opentaint/build-project/Gen Agent Trust Hub

build-project

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to perform project builds and manage dependencies, including opentaint compile, opentaint project, ./gradlew, mvn, and git submodule update. These are standard operations required for software compilation and environment setup.
  • [EXTERNAL_DOWNLOADS]: The skill triggers the download of external components and dependencies using standard tools like Git, Maven, and Gradle. These operations are directed at official registries or project-configured repositories.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with external project data, creating a potential surface for indirect prompt injection if target build files (e.g., build.gradle, pom.xml) contain malicious logic.
  • Ingestion points: Project configuration files and source code located in the project-root provided at runtime.
  • Boundary markers: None; the skill follows the project's native build definitions without explicit isolation or ignore-markers for embedded instructions.
  • Capability inventory: Shell execution capabilities via the opentaint binary and language-specific build wrappers.
  • Sanitization: No pre-execution sanitization of the target project's build scripts is performed, as the skill is intended to execute the project's own build workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 02:13 AM
Security Audit — agent-trust-hub — build-project