tinystruct-patterns
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a technical knowledge base for the tinystruct Java framework. All instructions and code examples focus on framework-specific implementation patterns such as extending
AbstractApplication, mapping@Actionroutes, and handling data with nativeBuilder/Builderscomponents. - [SAFE]: The skill incorporates security best practices by documenting a 'SECURITY WARNING' regarding prompt injection. It explicitly instructs developers to validate and sanitize arguments before returning them to an AI model's context window.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a potential attack surface by teaching the creation of MCP tools that process untrusted data (e.g., the
nameargument in thehellotool example). However, this is addressed with mandatory evidence including ingestion point identification, boundary markers (security warnings), and explicit sanitization examples (regex and length validation). - [SAFE]: All external resource references, such as the
org.tinystruct:tinystructMaven dependency, are standard components for the framework. No suspicious downloads, unauthorized command execution, or obfuscated patterns were detected in the skill files.
Audit Metadata