springboot-migration
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external project files through its migration scanner script.
- Ingestion points:
scripts/scan_migration_issues.pyreads and parsespom.xml,build.gradle,.javasource files, and Spring configuration files (.properties,.yml) from the user's local directory. - Boundary markers: The script generates a report using fixed text headers (e.g., 'MIGRATION SCAN REPORT', 'Next Steps') and severity icons to distinguish finding details from the agent's instructions.
- Capability inventory: The skill's capabilities are limited to reading local files and printing findings to standard output. It does not possess tools for network exfiltration, file system modification, or privileged command execution.
- Sanitization: The script extracts relevant technical metadata (versions, dependencies, and imports) via regular expressions but does not sanitize or escape the extracted strings before they are displayed in the report.
Audit Metadata