mybatis-patterns
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is entirely instructional, providing best practices for MyBatis XML and annotation-based configurations. It promotes security-first development by explicitly teaching the difference between safe pre-compiled variables and potentially unsafe direct string interpolation.
- [EXTERNAL_DOWNLOADS]: The skill contains links to well-known and reputable technical resources, including the official MyBatis project website, its GitHub repository, and Alibaba Cloud's developer portal. These references are appropriate for the skill's context and do not involve unauthorized code execution or data transfer.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for handling user-supplied data in database queries, which is a potential indirect injection surface. However, it mitigates this by providing secure templates: 1. Ingestion points: User requirements for dynamic SQL filters in XML mappers. 2. Boundary markers: Instruction to use
#{}ensures parameter binding acts as a boundary. 3. Capability inventory: No executable scripts or system-level tools are included. 4. Sanitization: Mandatory instructions for white-listing dynamic columns and using CONCAT for fuzzy searches.
Audit Metadata