quarkus-update
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the official
quarkusCLI tool with theupdate --dry-runflag to analyze potential migration paths. It also usesgit ls-remoteto query tags from the official repository. - [EXTERNAL_DOWNLOADS]: Fetches reference build files (e.g.,
pom.xml,build.gradle) and version metadata from thequarkusio/code-with-quarkus-compareGitHub repository. These are vendor-owned resources used for project comparison. - [PROMPT_INJECTION]: The skill processes untrusted local project files (
pom.xml,build.gradle) to extract version strings. While this represents an indirect injection surface, the extracted data is used solely to construct URLs for official vendor resources, posing minimal risk in this context.
Audit Metadata