spring-data-neo4j
Pass
Audited by Gen Agent Trust Hub on Feb 23, 2026
Risk Level: SAFECREDENTIALS_UNSAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: Configuration examples in
SKILL.mdandreferences/reference.mdinclude dummy hardcoded credentials (e.g.,password=secret). While intended as placeholders for documentation, they follow patterns for insecure credential storage. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface through data retrieved from Neo4j databases.
- Ingestion points: Data retrieved via
MovieRepositoryandUserRepositoryinreferences/examples.md. - Boundary markers: Not specified in the integration patterns.
- Capability inventory: Full CRUD operations on graph databases and command line access via Bash.
- Sanitization: The skill demonstrates best practices by using parameterized queries (
$param) to prevent Cypher injection into the database, but does not sanitize retrieved content for potential LLM instructions. - [COMMAND_EXECUTION]: The skill requires the
Bashtool to execute standard Maven and Gradle build commands and environment setup tasks. - [EXTERNAL_DOWNLOADS]: Fetches development dependencies and configuration from official Spring and Neo4j repositories via Maven and Gradle.
Audit Metadata