spring-boot-engineer
Fail
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: CRITICAL
Full Analysis
- [SAFE]: The skill follows secure coding standards for the Spring Framework, such as promoting constructor injection and proper exception handling to avoid leaking stack traces.
- [EXTERNAL_DOWNLOADS]: The skill references documentation hosted on GitHub Pages (jeffallan.github.io). Evidence: Documentation link at the end of SKILL.md. Although automated scanners flagged this URL, it is a legitimate resource belonging to the skill's author and is hosted on a well-known service (GitHub).
- [INDIRECT_PROMPT_INJECTION]: The skill generates Java code based on user-provided requirements. Evidence: Core Workflow step 1 in SKILL.md. While this represents a theoretical attack surface for indirect prompt injection, the skill includes explicit constraints for input validation and security configurations that align with its primary purpose as a development aid.
Recommendations
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata