quarkus-verification
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard build and test tools such as Maven (mvn), Gradle (./gradlew), and docker to perform local project verification. All operations are scoped to the development environment.
- [EXTERNAL_DOWNLOADS]: Fetches an OpenAPI specification from the local running service (localhost:8080) for documentation and security scanning with OWASP ZAP. These are standard development practices and do not involve executing untrusted remote code.
- [CREDENTIALS_UNSAFE]: Adheres to security best practices by recommending the use of environment variables for tokens (e.g., SONAR_TOKEN) rather than hardcoding secrets in the source code.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for ingesting outputs from build tools and security scanners.
- Ingestion points: Output from local CLI build and scan tools like Maven and JaCoCo.
- Boundary markers: None explicitly defined; the skill relies on agent interpretation of CLI output.
- Capability inventory: Local CLI tool execution and report generation.
- Sanitization: Not applicable as it involves local review of development artifacts.
Audit Metadata