spring-boot
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No attempts to override agent behavior or bypass safety guidelines were detected. The instructions focus on providing technical guidance for Spring Boot development.
- [DATA_EXFILTRATION]: No sensitive file access or unauthorized network operations were found. Network references are limited to local developer services (e.g., OTel collector) and illustrative placeholders (e.g., example.com).
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets are present. The skill provides security best practices, such as recommending 'when_authorized' for Actuator health details and using records for type-safe configuration properties.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns or unverified external scripts were detected. The dependencies listed (e.g., Spring Boot starters, Testcontainers) are standard industry libraries from trusted registries.
- [COMMAND_EXECUTION]: No dangerous or unauthorized shell command execution patterns were found. Included commands are standard development tasks like Maven/Gradle build runs.
- [OBFUSCATION]: No hidden content, encoded strings, or suspicious Unicode characters were identified across the documentation or code snippets.
- [PRIVILEGE_ESCALATION]: The skill does not contain instructions for acquiring elevated permissions or modifying system-level configurations.
- [PERSISTENCE]: No mechanisms for maintaining persistent access, such as modifying shell profiles or creating scheduled tasks, were detected.
- [DYNAMIC_EXECUTION]: The skill provides static Java code templates for developer use and does not implement dynamic code generation or runtime script execution.
- [INDIRECT_PROMPT_INJECTION]: The skill does not have an active data-ingestion surface that would expose the agent to indirect injection from untrusted external sources.
Audit Metadata