maven-indexer
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install an external package
maven-indexer-cliglobally using npm. This package is not associated with a pre-defined trusted organization or well-known service.\n- [COMMAND_EXECUTION]: The skill functionality depends on executing themaven-indexer-clitool with various subcommands to perform repository indexing, class searches, and metadata retrieval.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and displays code, Javadocs, and resources from local JAR files. If these files contain malicious instructions, the agent may follow them during processing.\n - Ingestion points: Local Maven/Gradle repository artifacts retrieved via
maven-indexer-cli get-classandmaven-indexer-cli search-resources(SKILL.md).\n - Boundary markers: Absent. The skill does not implement delimiters or ignore-instructions to isolate the retrieved content from the agent's logic.\n
- Capability inventory: The agent has the capability to execute shell commands and interact with the filesystem (SKILL.md).\n
- Sanitization: Absent. Content from artifacts is processed without validation or sanitization.
Audit Metadata