ruoyi-code-generator
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE] (SAFE): No malicious patterns, obfuscation, or data exfiltration attempts were detected in the skill instructions or templates.
- [NO_CODE] (SAFE): The skill does not include any executable scripts (.py, .js, .sh) or binaries. It operates entirely as a text-generation assistant using the provided markdown and Velocity (.vm) templates as a reference.
- [Indirect Prompt Injection] (LOW): The skill is designed to ingest untrusted user data (database schema details) to generate code. While it lacks explicit sanitization instructions, the risk is inherent to the code-generation use case.
- Ingestion points: User-provided parameters such as
tableName,tableComment, andcolumnsinSKILL.md. - Boundary markers: Absent; the agent is instructed to directly interpolate variables into templates.
- Capability inventory: The agent's capability is limited to generating code snippets and SQL scripts based on templates.
- Sanitization: No sanitization logic is specified, but the templates use standard MyBatis parameter binding (
#{}) which mitigates SQL injection in the generated application logic.
Audit Metadata