java-serialization-audit
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides educational content and audit workflows for identifying Java vulnerabilities. It correctly identifies dangerous sinks and suggests safe alternatives.
- [SAFE]: URLs provided in the reference material (e.g.,
attacker.com,evil.dtd) are standard placeholders used in security documentation to explain attack vectors and do not represent exfiltration or malicious communication. - [SAFE]: Code snippets are illustrative examples of vulnerable versus safe patterns intended for auditing source code, not for execution within the skill's own execution environment.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted Java source code, which technically constitutes an ingestion of external data. However, the use of structured detection checklists and the EVID evidence format provides sufficient boundary markers for a security-focused agent to maintain objectivity. (Internal assessment: LOW).
Audit Metadata