creating-springboot-projects
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill collects project constraints from the user (such as domain names, package paths, and module identifiers) and interpolates them into various code templates using placeholders. This creates a surface where maliciously crafted input could result in the generation of invalid or potentially harmful code structures in the output files.\n
- Ingestion points: Project assessment phase in
SKILL.md(Step 1).\n - Boundary markers: None present; there are no instructions to the agent to validate or sanitize these inputs before interpolation.\n
- Capability inventory: The skill uses the agent's file writing capabilities to create Java, SQL, and XML files based on the templates in the
assets/directory.\n - Sanitization: None present; the skill lacks logic to escape or filter external content before interpolation into the prompt templates.\n- [EXTERNAL_DOWNLOADS]: Reference documentation in the
references/directory contains URLs to external GitHub repositories, including official Spring Framework projects and community samples. These are provided as informational resources for the developer and do not involve automated execution or downloads by the agent.
Audit Metadata