effective-java
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/checkstyle_setup.pyscript downloads the official Checkstyle JAR from its official repository on GitHub. This download targets a well-known open-source project and is performed through standard Python libraries. - [COMMAND_EXECUTION]: The setup script generates a runner shell script (
run_checkstyle.sh) which uses thejavacommand to perform static analysis. It also modifies file permissions to make this generated script executable. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Java code for review, creating an ingestion surface for untrusted data. 1. Ingestion points: Java source code is ingested in
SKILL.mdandevals/evals.json. 2. Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are provided. 3. Capability inventory: The skill environment includes scripts that can download files and execute shell commands. 4. Sanitization: No explicit sanitization or filtering of the ingested Java code is performed before processing.
Audit Metadata