java-add-graalvm-native-image-support
Pass
Audited by Gen Agent Trust Hub on Feb 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard build commands and the GraalVM tracing agent to analyze projects. Evidence:
mvn -Pnative native:compile,./gradlew nativeCompile, andjava -agentlib:native-image-agent=.... - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user project files which can influence agent behavior. 1. Ingestion points: Reads project files such as
pom.xml,build.gradle, and Java source code. 2. Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded commands in the project data. 3. Capability inventory: Executes shell commands (mvn,gradle,java) and writes configuration and source files to the file system. 4. Sanitization: Absent. The skill does not validate or sanitize the content of the analyzed files before processing them or using them in command execution.
Audit Metadata