springboot-verification

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard build and verification commands using Maven and Gradle (e.g., mvn clean verify, ./gradlew assemble). These operations are consistent with the skill's stated purpose of project verification.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes well-known Maven/Gradle plugins (such as OWASP Dependency Check, SpotBugs, and Jacoco) and the official postgres:16-alpine Docker image via Testcontainers. These resources are sourced from trusted public registries and are standard in modern Java development.\n- [PROMPT_INJECTION]: The skill analyzes local source files and git diffs, creating a surface for indirect prompt injection where instructions embedded in the code could potentially influence agent behavior.\n
  • Ingestion points: Reads source files in the src/ directory and output from git diff.\n
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content are used when processing the codebase.\n
  • Capability inventory: Employs high-capability tools including build systems (mvn, gradlew) and version control (git).\n
  • Sanitization: No sanitization or validation of code content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 07:42 AM
Security Audit — agent-trust-hub — springboot-verification