java-spring

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references several external GitHub repositories and official documentation sites (e.g., github/awesome-copilot, spring-projects, docs.spring.io) for content attribution and technical guidelines. These references target well-known organizations and community projects.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and provide guidance on external project files like pom.xml and application.yml. This creates a surface where malicious instructions embedded in a user's project files could theoretically influence the agent. Ingestion points: pom.xml, application.yml, and source code. Boundary markers: none specified. Capability inventory: shell execution via Maven/Gradle wrappers and Docker. Sanitization: not implemented in the skill instructions.
  • [COMMAND_EXECUTION]: The documentation describes the use of standard Java build tool wrappers (./mvnw, ./gradlew) and Docker for building and verifying Spring Boot applications. These are standard industry tools used for their intended purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 09:00 AM