170-java-documentation
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands via the Maven wrapper (e.g.,
./mvnw validate,./mvnw javadoc:javadoc) to ensure project integrity and validate documentation. This is standard behavior for Java development tools and is used here for safety checks.- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it performs deep analysis of the project's source code to generate documentation content. Ingestion points: The skill reads all files insrc/main/javaand existing documentation files. Boundary markers: There are no explicit markers or 'ignore' instructions for the data being ingested. Capability inventory: The agent can read files and execute shell commands (./mvnw). Sanitization: No validation or escaping is applied to the content of the Java files before they are processed by the agent. However, the high degree of human-in-the-loop interaction and specific documentation focus mitigates this risk.
Audit Metadata