container-native-deployment
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The core instructions in SKILL.md advocate for industry-standard security practices, including non-root user execution, read-only filesystems, and supply chain scanning using SBOMs.
- [EXTERNAL_DOWNLOADS]: The skill references guidelines and configuration details from the official Spring Framework documentation and its GitHub repository, which are recognized as well-known and trusted sources.
- [CREDENTIALS_UNSAFE]: The file examples/bad-dockerfile includes a hardcoded placeholder credential (DATABASE_PASSWORD=production-secret). This is provided as an explicit example of an anti-pattern to avoid, consistent with the skill's educational purpose.
- [COMMAND_EXECUTION]: The Dockerfile examples include execution of the Maven wrapper (./mvnw) and the Java runtime (java -jar), which are standard and necessary commands for building and running Java applications.
Audit Metadata