The Agent Skills Directory

[SAFE]: The skill's primary purpose is providing technical reference for Spring Boot migration. Analysis of the 19 files shows no evidence of malicious intent or hidden behaviors.\n- [EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch documentation from well-known technology sites such as spring.io, Moderne, Baeldung, and Dan Vega's personal technical blog. These are documented neutrally as sources for up-to-date migration guidance and do not involve executing untrusted remote code.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to run standard build automation commands (mvn, gradle) and a local verification script (verify_migration.sh) to assess the codebase. These operations are routine for Java development and are restricted to project analysis.\n- [PROMPT_INJECTION]: The skill does not contain instructions that attempt to bypass AI safety constraints or override system behavior.\n- [DATA_EXFILTRATION]: No sensitive file access (e.g., SSH keys, credentials) or unauthorized network operations were identified.\n- [SAFE]: Indirect Prompt Injection Surface Analysis:\n
Ingestion points: Reads project source code, build scripts, and configuration files from the user project.\n
Boundary markers: None present to distinguish project data from migration instructions.\n
Capability inventory: The agent can execute shell commands (Bash) and perform web searches/fetches.\n
Sanitization: No specific sanitization of ingested project content is documented.\n
Conclusion: The risk of indirect prompt injection is rated low due to the specialized focus of the tool on Spring framework artifacts.

spring-boot-4-migration