hunt-springboot
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for fingerprinting and testing Spring Boot applications for common misconfigurations and vulnerabilities. All operations are directed at a user-defined target variable ($TARGET).
- [REMOTE_CODE_EXECUTION]: Automated alerts regarding remote code execution are false positives. The commands
curl ... | python3 -m json.toolutilize the Python interpreter to format and pretty-print JSON responses from the target, rather than executing the downloaded content as a script. - [COMMAND_EXECUTION]: The skill documents various exploit payloads for Spring Expression Language (SpEL) injection, Spring4Shell, and H2 console vulnerabilities. These are provided as examples for security professionals to test the resilience of target environments.
- [DATA_EXFILTRATION]: The skill includes procedures for extracting sensitive information, such as environment variables and credentials, from exposed Spring Boot Actuator endpoints on a target system. This functionality is intended for security assessments and does not target the agent's or user's own data.
Audit Metadata