springboot-verification
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard build and verification commands using Maven and Gradle (e.g.,
mvn clean verify,./gradlew assemble). These operations are consistent with the skill's stated purpose of project verification.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes well-known Maven/Gradle plugins (such as OWASP Dependency Check, SpotBugs, and Jacoco) and the officialpostgres:16-alpineDocker image via Testcontainers. These resources are sourced from trusted public registries and are standard in modern Java development.\n- [PROMPT_INJECTION]: The skill analyzes local source files and git diffs, creating a surface for indirect prompt injection where instructions embedded in the code could potentially influence agent behavior.\n - Ingestion points: Reads source files in the
src/directory and output fromgit diff.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded content are used when processing the codebase.\n
- Capability inventory: Employs high-capability tools including build systems (
mvn,gradlew) and version control (git).\n - Sanitization: No sanitization or validation of code content is performed before processing.
Audit Metadata