java-spring
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external GitHub repositories and official documentation sites (e.g., github/awesome-copilot, spring-projects, docs.spring.io) for content attribution and technical guidelines. These references target well-known organizations and community projects.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and provide guidance on external project files like pom.xml and application.yml. This creates a surface where malicious instructions embedded in a user's project files could theoretically influence the agent. Ingestion points: pom.xml, application.yml, and source code. Boundary markers: none specified. Capability inventory: shell execution via Maven/Gradle wrappers and Docker. Sanitization: not implemented in the skill instructions.
- [COMMAND_EXECUTION]: The documentation describes the use of standard Java build tool wrappers (./mvnw, ./gradlew) and Docker for building and verifying Spring Boot applications. These are standard industry tools used for their intended purpose.
Audit Metadata