create-spring-boot-java-project
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a project ZIP archive from start.spring.io, which is the official and well-known Spring Initializr service.
- [COMMAND_EXECUTION]: Executes common development tools including java, curl, unzip, and the Maven wrapper (./mvnw) to set up and verify the project structure.
- [CREDENTIALS_UNSAFE]: Hardcodes default development passwords (rootroot) in the generated application.properties and docker-compose.yaml files for local services like Redis, PostgreSQL, and MongoDB.
Audit Metadata