data-upload-java-cli
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Python and shell scripts that execute a local Java JAR file (domoutil.jar) located at a hardcoded path (/Users/elliottleonard/Documents/Cursor/CLI/domoutil.jar). It utilizes subprocess.run and standard input piping to pass commands to the tool.
- [DYNAMIC_EXECUTION]: Automation scripts dynamically generate command strings (containing server URLs, tokens, and file paths) at runtime to be executed by the Java CLI.
- [INDIRECT_PROMPT_INJECTION]: The skill processes CSV file headers using the derive-schema command and parses the output to generate a JSON schema. This constitutes a surface where untrusted data (CSV headers) is ingested and used to form parameters for subsequent API-related actions. Evidence Chain: (1) Ingestion Point: Output of derive-schema -d {csv_path} in SKILL.md; (2) Boundary Markers: Absent; (3) Capability Inventory: subprocess.run, java -jar, and file writing; (4) Sanitization: Absent, parsed column names are mapped directly to JSON keys.
Audit Metadata