spring-ai-alibaba
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely educational, providing guidance and documentation for the Spring AI Alibaba framework without executing any scripts or commands.
- [CREDENTIALS_UNSAFE]: The skill demonstrates safe credential management by using environment variable placeholders (
${DASHSCOPE_API_KEY}) in configuration examples (application.ymlandapplication.properties) rather than hardcoding sensitive keys. - [EXTERNAL_DOWNLOADS]: The skill references legitimate, well-known Maven and Gradle dependencies from the
com.alibaba.cloud.aigroup, which is the official provider for Alibaba Cloud's Spring AI integration. - [PROMPT_INJECTION]: The
PromptServiceandChatServicesnippets demonstrate prompt interpolation of user-supplied variables (style,question). While this creates a surface for indirect prompt injection, it is a standard implementation of the documented framework'sPromptTemplatefeature and is presented for educational purposes.
Audit Metadata