spring-boot-attack-probe
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute network probing commands (GET/POST) against a user-specified base URL to discover exposed diagnostic endpoints and security gaps.
- [EXTERNAL_DOWNLOADS]: Rule SB-ACT-003 describes a procedure to download up to 1MB of an application heap dump file (
/actuator/heapdump) to verify exposure. The skill includes specific warnings to limit the download size and avoid parsing for credentials. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests and processes responses from external web servers.
- Ingestion points: Data enters the agent context via the response bodies of various HTTP requests defined in the 'Rules' section (e.g.,
/actuator/env,/actuator/info). - Boundary markers: No specific delimiters or instructions are provided to the agent to treat server responses as untrusted data or to ignore embedded instructions.
- Capability inventory: The agent has capabilities for network operations (probing) and potentially file system access depending on the environment.
- Sanitization: There is no explicit sanitization or validation of the data returned by the target server before it is processed by the agent.
Audit Metadata