The Agent Skills Directory

[SAFE]: The skill provides instructions for using OpenRewrite, a widely recognized and trusted open-source tool for automated code refactoring in the Java ecosystem. It fetches recipes from official Maven repositories (org.openrewrite).
[SAFE]: The skill includes a verification script (verify_migration.sh) that uses standard shell utilities like grep, find, and sed to audit project build files for deprecated configurations and compatibility bridges. The script also runs standard build commands (mvn compile or gradle compileJava) which are expected behaviors for a migration tool.
[DATA_EXPOSURE_&_EXFILTRATION]: No evidence of hardcoded credentials, sensitive file path access (outside of project source code), or unauthorized network exfiltration was found. The skill suggests using gh (GitHub CLI) and WebSearch to verify documentation, which are standard investigative tasks for an agent.
[PROMPT_INJECTION]: The instructions are technical and focused on Spring Boot migration. No prompt injection attempts, jailbreak patterns, or instructions to ignore safety filters were detected.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a typical indirect prompt injection surface as it reads and processes untrusted project source code and build files. However, this is inherent to its primary purpose as a migration assistant. Findings:
Ingestion points: Reads project files (pom.xml, build.gradle, source code) via Glob, Grep, and Read tools.
Boundary markers: The instructions contextually separate migration guidance from user data processing.
Capability inventory: Uses Bash to execute verification scripts and build commands.
Sanitization: Standard for instructional skills; relies on the underlying agent platform's tool constraints.

spring-boot-4-migration