314-frameworks-spring-kafka
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows secure development practices by enforcing compilation checks before and after changes using standard Maven commands (
./mvnw compile,./mvnw clean verify). - [PROMPT_INJECTION]: No evidence of prompt injection or instructions to bypass safety guidelines was found. The instructions are focused on technical implementation and architectural best practices.
- [DATA_EXFILTRATION]: No sensitive file paths, hardcoded credentials, or unauthorized network operations were identified. All network-related examples (Kafka brokers) are within the context of local development or controlled integration testing environments (Testcontainers, EmbeddedKafka).
- [COMMAND_EXECUTION]: Shell commands are limited to standard build tool invocations (
mvn,./mvnw) which are appropriate for a developer-centric skill. No arbitrary or malicious command execution patterns were found. - [REMOTE_CODE_EXECUTION]: There are no patterns involving the download and execution of remote scripts from untrusted sources. External dependencies (e.g.,
spring-boot-starter-kafka,testcontainers) are standard industry libraries. - [EXTERNAL_DOWNLOADS]: References to external repositories and services (Testcontainers, Docker images) are used for legitimate testing purposes. The skill includes a specific safety recommendation to use organization-approved, pinned images rather than arbitrary public ones.
- [INDIRECT_PROMPT_INJECTION]: The skill explicitly warns against building topic names or Kafka header values from untrusted user input, effectively mitigating common injection surfaces in messaging systems.
Audit Metadata