spring-boot-engineer
Fail
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill contains a documentation reference to
https://jeffallan.github.io/claude-skills/skills/backend/spring-boot-engineer/, which has been flagged as malicious and blacklisted by automated security scanners. - [METADATA_POISONING]: A metadata discrepancy was detected where the skill identifies its author as
Jeffallan, which does not match the established author context ofyo-steven. This inconsistency is a common indicator of unauthorized distribution or potential tampering. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user requirements (ingestion point) to generate and execute Java code and build commands like
./mvnw test(capability). It lacks boundary markers or explicit instructions to ignore malicious commands embedded within user requirements, creating a surface for prompt injection attacks that could lead to unauthorized code execution.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata