spring-boot-in-action
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: Examples of hardcoded passwords such as "secret123" and "S3cr3tP@ss" are present in
examples/before.mdandevals/evals.json. These are explicitly documented as anti-patterns or utilized as test cases to verify the agent's ability to detect and remediate credential exposure. - [COMMAND_EXECUTION]: The skill includes a local Python script
scripts/review.pydesigned to perform static analysis on source code. It uses regular expressions to identify common Spring Boot anti-patterns without executing the target code. - [PROMPT_INJECTION]: The skill is designed to ingest and review user-provided source code, which introduces a surface for indirect prompt injection.
- Ingestion points: User-provided Java files and Spring configuration files (properties/YAML) are ingested in Code Review mode as defined in
SKILL.md. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the analyzed code.
- Capability inventory: The skill uses
scripts/review.pyfor local file scanning and provides suggestions for code modifications. - Sanitization: There is no explicit sanitization or filtering of comments or strings within the ingested source code.
Audit Metadata