java-spring-framework
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides documentation on scaffolding new projects using
start.spring.io, which is the official and trusted Spring Initializr service. This is a standard developer workflow and does not involve untrusted third-party code. - [INDIRECT_PROMPT_INJECTION]: As a code-generation and architectural skill, it ingests user requirements to produce backend designs. The skill mitigates risks associated with untrusted data by providing extensive documentation and implementation templates for security best practices, including Spring Security 7 (JWT/OAuth2) and Jakarta Bean Validation 3.1.
- [REMOTE_CODE_EXECUTION]: Contains a template command for fetching a project archive from the official Spring Initializr (
curl https://start.spring.io/starter.tgz | tar -xzvf -). While this downloads files, it is the standard method for project initialization from a well-known service and does not execute arbitrary shell scripts.
Audit Metadata