{"data":{"skill":{"slug":"github-java-springboot","name":"java-springboot","icon":"📦","repo":"https://github.com/github/awesome-copilot/tree/main/skills/java-springboot/","status":"approved","author":"github","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"3f4866bc-bc65-44a0-8c74-c608485f6ec6","skill_id":"baacc7fc-1a8b-43b4-bee3-5c46e4f5bf89","version":5,"content_hash":"v3:c43861a65bb95efcae259cd161c9d6f4dc7eec6f:574898202ce298557226c49d35036a6e9e66a1cb205ea15c44db298e6d74e3bd:505ed9b2d2ae629ca74b6570aae3c1844a54c9ecd42e7a53c97ec3e12be038c6:736b696c6c732f6769746875622f6a6176612d737072696e67626f6f74:cb2ee630669e88b716e38867168a0594","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 18 static findings are false positives caused by Markdown inline-code backticks around Spring Boot names and Java examples. SKILL.md contains guidance only, with no shell execution, prompt injection, data exfiltration, or other semantic security concern.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":58,"line_start":58}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":66,"audit_model":"codex","audited_at":"2026-07-23T18:04:15.96+00:00","created_at":"2026-07-25T11:08:57.64553+00:00","static_findings":[{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Build Tool:** Use Maven (`pom.xml`) or Gradle (`build.gradle`) for dependency management.","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Starters:** Use Spring Boot starters (e.g., `spring-boot-starter-web`, `spring-boot-starter-data","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Package Structure:** Organize code by feature/domain (e.g., `com.example.app.order`, `com.exampl","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Immutability:** Declare dependency fields as `private final`.","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Component Stereotypes:** Use `@Component`, `@Service`, `@Repository`, and `@Controller`/`@RestCo","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Externalized Configuration:** Use `application.yml` (or `application.properties`) for configurat","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Type-Safe Properties:** Use `@ConfigurationProperties` to bind configuration to strongly-typed J","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Profiles:** Use Spring Profiles (`application-dev.yml`, `application-prod.yml`) to manage enviro","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Validation:** Use Java Bean Validation (JSR 380) with annotations (`@Valid`, `@NotNull`, `@Size`","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Error Handling:** Implement a global exception handler using `@ControllerAdvice` and `@Exception","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Business Logic:** Encapsulate all business logic within `@Service` classes.","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Transaction Management:** Use `@Transactional` on service methods to manage database transaction","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Spring Data JPA:** Use Spring Data JPA repositories by extending `JpaRepository` or `CrudReposit","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Custom Queries:** For complex queries, use `@Query` or the JPA Criteria API.","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Logger Declaration:** `private static final Logger logger = LoggerFactory.getLogger(MyClass.clas","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Parameterized Logging:** Use parameterized messages (`logger.info(\"Processing user {}...\", userI","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Integration Tests:** Use `@SpringBootTest` for integration tests that load the Spring applicatio","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Test Slices:** Use test slice annotations like `@WebMvcTest` (for controllers) or `@DataJpaTest`","category":"external_commands","line_end":58,"severity":"medium","line_start":58}],"finding_verdicts":[{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"The backticks format Maven and Gradle filenames as inline Markdown; they do not invoke a shell or Ruby runtime.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The backticks format Spring Boot dependency identifiers as inline Markdown, with no command execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"The backticks format example Java package names as inline Markdown; no executable expression is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"The backticks format a Java field modifier as inline Markdown, not a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"The backticks format Spring component annotations as inline Markdown, with no execution mechanism.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The backticks format Spring configuration filenames as inline Markdown; they are not executable commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The backticks format a Spring annotation as inline Markdown, with no shell or Ruby execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The backticks format environment profile filenames as inline Markdown; no command is requested.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks format Java validation annotations as inline Markdown, not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks format Spring exception-handling annotations as inline Markdown, with no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks format the Spring Service annotation as inline Markdown; no shell operation exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The backticks format the Spring Transactional annotation as inline Markdown, not a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks format Java repository interface names as inline Markdown; they do not trigger execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The backticks format the Spring Query annotation as inline Markdown, with no shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The backticks delimit a static Java logger declaration example; Markdown does not execute that example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The backticks delimit a Java logging example for documentation, with no runtime execution path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks format the Spring Boot test annotation as inline Markdown, not an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The backticks format Spring test-slice annotations as inline Markdown, with no execution instruction.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"c43861a65bb95efcae259cd161c9d6f4dc7eec6f","subject_content_hash":"574898202ce298557226c49d35036a6e9e66a1cb205ea15c44db298e6d74e3bd","subject_tree_hash":"505ed9b2d2ae629ca74b6570aae3c1844a54c9ecd42e7a53c97ec3e12be038c6","subject_plugin_path":"skills/github/java-springboot","audit_payload_hash":"cb2ee630669e88b716e38867168a0594","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"c43861a65bb95efcae259cd161c9d6f4dc7eec6f","contentHash":"574898202ce298557226c49d35036a6e9e66a1cb205ea15c44db298e6d74e3bd","treeHash":"505ed9b2d2ae629ca74b6570aae3c1844a54c9ecd42e7a53c97ec3e12be038c6","pluginPath":"skills/github/java-springboot","auditPayloadHash":"cb2ee630669e88b716e38867168a0594"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/github-java-springboot/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}