spring-mvc-webflux-api-builder
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to verify existing project details, such as the Spring stack type (MVC vs. WebFlux), error formats, and serialization rules. Analyzing local project files creates a theoretical surface for indirect prompt injection if the analyzed codebase contains malicious instructions. However, this is a standard requirement for code-generation skills and includes guardrails against leaking internal exception details.
- Ingestion points: Local repository configuration and code files (via instructions to 'Verify the module', 'Verify existing error format').
- Boundary markers: None explicitly defined.
- Capability inventory: Generation of Kotlin source code, including DTOs, controllers, services, and tests.
- Sanitization: None mentioned for ingested codebase data.
- [SAFE]: The skill does not perform any network operations, download external code, or access sensitive system files. All metadata and instructions are consistent with the stated purpose of building Spring APIs.
Audit Metadata