Spring Boot 2 To 3

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:39 AM UTC
• Version: 1.0.1

Overview

The skill is a legitimate Spring Boot migration guide, but it gives agents broad authority to change and commit project code without asking and includes mutable remote build commands.

Install only if you are comfortable with an agent making broad repository changes. Before use, require explicit approval before git add, commit, reset, checkout, Dockerfile, CI, or dependency changes; pin OpenRewrite plugin and recipe versions instead of using LATEST; run migrations in a least-privileged environment without production credentials; and review generated diffs before committing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: references/openrewrite-recipes.md:64
• Finding: Unpinned OpenRewrite Recipe Dependency Permits Mutable Supply-Chain Code Execution## Vulnerability Details **File Location**: `references/openrewrite-recipes.md`, lines 64–66 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: High ### Technical Analysis The documented one-shot migration command resolves the OpenRewrite recipe artifact using the mutable `LATEST` version: ```bash ./mvnw -U org.openrewrite.maven:rewrite-maven-plugin:run \ -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-spring:LATEST \ -Drewrite.activeRecipes=org.openrewrite.java.spring.boot3.UpgradeSpringBoot_3_5 ``` `LATEST` does not identify a stable, previously reviewed artifact. Maven consults remote repository metadata at execution time and selects whichever version is then designated as the latest release. The `-U` option further directs Maven to check remote repositories for updated metadata and artifacts. OpenRewrite recipe artifacts contain executable Java components loaded by the Rewrite plugin. Consequently, executing this command gives the newly resolved artifact the ability to run in the Maven process and intentionally modify the target repository. The effective executable dependency can therefore change after this skill package has been audited, without any corresponding change to the reviewed documentation. Although the document elsewhere recommends looking up current versions, this executable example explicitly uses `LATEST`, preventing reproducible resolution and bypassing meaningful version review or approval controls. ### Attack Path 1. An attacker compromises the upstream `rewrite-spring` publishing process, an authorized publisher account, or a repository through which Maven resolves the artifact. 2. The attacker publishes a malicious or compromised version that becomes the version represented by `LATEST`. 3. An agent follows the documented migration command. 4. Maven refreshes repository metadata because of `-U` and downloads the attacker-controlled recipe artifact. 5. ...[truncated 1552 chars]
• Remediation: ## Remediation Suggestions 1. Replace `LATEST` with an explicit, reviewed recipe version: ```bash ./mvnw org.openrewrite.maven:rewrite-maven-plugin:PINNED_PLUGIN_VERSION:run \ -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-spring:PINNED_REWRITE_SPRING_VERSION \ -Drewrite.activeRecipes=org.openrewrite.java.spring.boot3.UpgradeSpringBoot_3_5 ``` 2. Pin the OpenRewrite Maven plugin version as well, either in `pom.xml` or in the fully qualified command, so all executable components are deterministic. 3. Remove `-U` from routine migration commands. Use it only during an explicit, controlled dependency-update process. 4. Verify selected versions against official release records and review release notes before execution. 5. Enforce trusted Maven repositories through organization-controlled `settings.xml` mirrors. Disable unapproved repositories declared by projects or transitive build configuration. 6. Use repository-manager checksum and signature validation where available. Record resolved artifact versions and hashes in migration logs. 7. Run OpenRewrite in an isolated, least-privileged environment without production credentials, unnecessary filesystem access, or unrestricted network access. 8. Review the complete generated diff before staging or committing it. Do not automatically treat recipe-generated changes as trusted. 9. Configure automated dependency-update tooling to propose reviewed version bumps rather than selecting mutable versions at execution time.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Detect build tool (`pom.xml` or `build.gradle`/`build.gradle.kts`), Java version, and test commands. **Confirm the project is on Spring Boot 2.7.x** (from parent or property); if not, stop and ask the user to upgrade to 2.7.x before using this skill.
2. **Verify the project compiles and tests pass** (e.g. `./mvnw -q compile test` or `./gradlew build`). Do not start migration until baseline is green; if there are known failures, document them and get user sign-off before proceeding.
3. Record current versions for Spring Boot, Spring Cloud, Spring Security, Hibernate, and API doc libs.
4. **Create safety checkpoints** only after baseline is green. **Run the following git command yourself** (do not ask the user to run it). The **current branch** (e.g. `main`) is already the rollback anchor—no need to create a separate backup branch. Create and switch to a **working branch** for the migration: `git checkout -b upgrade/sb3-<target-version>`. If rollback is needed, switch back to the original branch or compare against it.
5. Run the check script from this skill’s `scripts/` directory, passing the target project path: `scripts/check.sh <project-dir>` (e.g. from workspace root: `spring-boot-2-to-3/scripts/check.sh <project-dir>`). It captures Boot version hints, `javax` residue, and Springfox usage.
6. Save baseline artifacts (`dependency tree`, test summary, startup log) under the `docs/` directory.
7. If the project ships with a **Dockerfile** (or similar container build), record the current Java base image (e.g. `eclipse-temurin:11-jdk`) so it can be aligned to the target Java version (17 or 21) after the code migration.

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to make repository-changing decisions and execute git operations on the user's behalf. Even though the stated purpose is migration safety, autonomous branching, rollback, and file-modifying actions reduce user oversight and can lead to unintended state changes, data loss, or execution in the wrong repository/path.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### 2) Apply OpenRewrite First

1. Use OpenRewrite recipes to perform the broad mechanical migration from Boot 2 to Boot 3.
2. **Run** `git add` and `git commit` for the recipe-generated changes only (message prefix `chore(rewrite):`). Do not ask the user to commit.
3. Build and run tests to expose remaining manual issues.
4. If the target project has its own OpenRewrite/migration scripts, run those and retain stage logs.

• Confidence: 94% confidence
• Finding: This step directs the agent to stage and commit changes automatically after running migration recipes. Automatic commits can persist unintended modifications, mask risky transformations inside large mechanical changes, and make review harder if done without explicit approval or scoped diff inspection.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

3. Align dependent libraries to Boot 3 compatible versions.
4. Keep fixes scoped and grouped by concern.
5. If identical issues appear across modules/repos, extract them into custom OpenRewrite recipes for reuse.
6. **Run** `git add` and `git commit` once per topic (e.g. `jakarta`, then `security`, `httpclient`, `tests`) to keep rollback granular. Execute the commits yourself; do not ask the user to run git.
7. **Dockerfile**: Upgrade the Java base image in `Dockerfile` (or container build) to match the target JDK (17+ or 21). Use OpenRewrite [rewrite-docker](https://docs.openrewrite.org/recipes/docker) (e.g. `Change Docker FROM`) or a text-based recipe; see [references/openrewrite-recipes.md](references/openrewrite-recipes.md) and [references/manual-fix-checklist.md](references/manual-fix-checklist.md).

Load [references/manual-fix-checklist.md](references/manual-fix-checklist.md) and execute only relevant sections.

• Confidence: 95% confidence
• Finding: The skill again authorizes the agent to autonomously commit topic-based changes and modify deployment artifacts such as Dockerfiles. This expands the blast radius beyond source changes into supply-chain/runtime configuration, so an incorrect or unsafe edit could affect builds, production images, or rollback integrity without the user explicitly authorizing each step.