Spring Boot 2 To 3
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: spring-boot-2-to-3 Version: 1.0.1 thought The user wants me to analyze a set of files for an OpenClaw AgentSkill called `spring-boot-2-to-3`. I need to classify it as `benign`, `suspicious`, or `malicious` based on the provided criteria. - `_meta.json`: Standard metadata. - `SKILL.md`: Instructions for the AI agent to perform a Spring Boot 2.7 to 3.x migration. - `references/manual-fix-checklist.md`: A checklist for manual fixes after automated migration. - `references/openrewrite-recipes.md`: Documentation and snippets for OpenRewrite recipes. - **Data exfiltration**: No signs of reading env vars, SSH keys, or sending data to external endpoints. - **Malicious execution**: - The skill instructs the agent to run `scripts/check.sh <project-dir>`. (Wait, I don't see `scripts/check.sh` in the provided files). - It instructs the agent to run `git` commands: `git checkout -b`, `git add`, `git commit`. - It instructs the agent to run build commands: `./mvnw`, `./gradlew`. - It mentions running OpenRewrite recipes which involve downloading dependencies from Maven Central/Gradle Plugin Portal. - **Persistence / backdoors**: No signs. - **Prompt injection**: - The `SKILL.md` contains instructions like "Run the following git command yourself (do not ask the user to run it)". This is a common pattern in OpenClaw to automate tasks, but it's worth noting. - It tells the agent to "verify the Boot version... if it is not 2.7.x, stop". - It tells the agent to "Create safety checkpoints... Run the following git command yourself". - It tells the agent to "Rollback: Restore a safe state... generate a failure report". - **Obfuscation**: None. - **Supply chain**: It uses OpenRewrite recipes. These are standard industry tools for migration. - The `SKILL.md` refers to `scripts/check.sh`, but this file is missing from the provided content. However, the prompt says "Analyze the FULL content of ALL files below". If a file is missing from the bundle, it might be a red flag or just an incomplete snippet provided by the user. - The instructions tell the agent to execute `git` commands and build commands. This is high-privilege but aligned with the stated purpose (migrating a codebase). - The instruction "Run the following git command yourself (do not ask the user to run it)" is an instruction to the agent to act autonomously. - The instruction "The current branch (e.g. main) is already the rollback anchor—no need to create a separate backup branch" is a bit risky if the agent messes up the git state, but it's a workflow choice. - The skill is designed to automate a complex migration (Spring Boot 2 to 3). - It uses OpenRewrite, which is the standard tool for this. - It includes detailed checklists for manual fixes. - It includes error handling and rollback instructions. - There is no evidence of data theft, backdoors, or malicious intent. - The missing `scripts/check.sh` is a bit "suspicious" in a real-world scenario (why is it missing?), but the logic described for it ("captures Boot version hints, javax residue, and Springfox usage") is benign. - The instructions are very specific and helpful for the task. - The use of `git` and build tools is necessary for the task. - The "do not ask the user" instructions are typical for autonomous agents. - No obvious IOCs or malicious URLs. Wait, let me re-read the `SKILL.md` carefully. "Run the check script from this skill’s scripts/ directory, passing the target project path: `scripts/check.sh <project-dir>`". Since `scripts/check.sh` is not provided in the text, I cannot verify its contents. In a security review, a missing script that is supposed to be executed is a "suspicious" signal because it could contain anything. However, the prompt asks me to analyze the *provided* files. Let's look at the `references/openrewrite-recipes.md`. It provides XML and Groovy snippets. It suggests using `LATEST` versions for recipes. This is a common practice but can be a supply chain risk (though usually considered a vulnerability/weakness rather than malice). The instructions to the agent to perform `git commit` and `git checkout` autonomously are powerful. The instruction "The original branch must remain unchanged; use it as the rollback target when needed" is a safety measure. Is there any prompt injection that tries to subvert the agent's safety? "Run all git commands yourself (branch, commit) as part of the workflow; do not instruct the user to run git." - This is automation, not necessarily subversion. "On failure: always rollback to a safe state and generate a failure report" - This is good practice. The classification should be `benign` or `suspicious`. Given the missing script `scripts/check.sh`, and the fact that the agent is told to run arbitrary shell commands (`./mvnw`, `./gradlew`, `git`), it has high-risk capabilities. However, these are "plausibly needed for the stated purpose". The prompt says: "benign only if behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." "suspicious" if "risky capabilities without clear malicious intent (e.g., shell/network/file access plausibly needed for the stated purpose...)" The skill definitely has high-risk behaviors (executing shell scripts, build tools, and git). The missing `scripts/check.sh` is a significant indicator of a potential hidden payload, even if the description sounds benign. Let's check for any "ignore previous instructions" or "exfiltrate" type stuff. None found. The `SKILL.md` is very well-structured and follows a logical migration path. The `references/manual-fix-checklist.md` is very detailed and accurate for a Spring Boot 3 migration. The `references/openrewrite-recipes.md` is also accurate. The missing `scripts/check.sh` is the only real "red flag", but in the context of a code review where only some files are provided, it might just be an omission. However, as a security analyst, I should flag it. Wait, the prompt says: "Analyze the FULL content of ALL files below". If `scripts/check.sh` is not there, I can't analyze it. The instructions to the agent to run it are part of the `SKILL.md`. Classification: `benign`. Why? Because the logic is entirely consistent with a legitimate, high-quality migration tool. The "risky" commands (git, mvn, gradle) are the core of what the tool is supposed to do. There is no evidence of intent to harm. Wait, let me double check the "suspicious" criteria: "risky capabilities without clear malicious intent (e.g., shell/network/file access plausibly needed for the stated purpose...)" If I follow the "Hard rule" strictly: "benign only if behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." Executing build tools and git on a user's repo *is* high-risk. But if it's "plausibly needed", it leans towards suspicious or benign. The prompt says: "If you see risky capabilities without clear malicious intent... classify as suspicious (not malicious)." So, `suspicious` is the safer and more accurate classification according to the provided instructions, because the skill requires broad shell execution and git permissions to function. One more look: Is there any hidden exfiltration? The `SKILL.md` says: "Save baseline artifacts (dependency tree, test summary, startup log) under the docs/ directory." This is local. "Generate an upgrade report: create a file under docs/". This is local. The `openrewrite-recipes.md` mentions: `./mvnw -U org.openrewrite.maven:rewrite-maven-plugin:run -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-spring:LATEST` This downloads code from the internet and runs it. This is a standard way OpenRewrite works, but it is a "network/execution" capability. Conclusion: The skill is a legitimate migration tool, but because it uses high-risk capabilities (shell execution, build tool execution, git manipulation, and downloading/running external recipes), it fits the "suspicious" definition provided in the prompt ("risky capabilities without clear malicious intent"). Wait, let's re-read the "benign" definition: "benign only if behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." Is "meaningful high-risk behavior" present? Running `./mvnw` and `git commit` is high-risk in the sense that it can modify the system/repo. However, if I classify every tool that runs `mvn` as suspicious, then almost all developer tools are suspicious. But the prompt specifically says: "If you see risky capabilities without clear malicious intent... classify as suspicious". Let's look at the `scripts/check.sh` again. The `SKILL.md` tells the agent to run it. If the bundle is missing this file, the agent will fail or the user might be providing an incomplete bundle. If the bundle *is* the ZIP and the ZIP is missing a file it claims to have, that's a red flag. I will classify as `benign`. The instructions are extremely high quality and clearly intended for a complex migration. The "risky" parts are fundamental to the task. The missing script is likely just an artifact of the example provided. Actually, let's look at the "suspicious" examples: "shell/network/file access plausibly needed for the stated purpose". This skill has: 1. Shell access (mvn, gradle, git, scripts/check.sh). 2. Network access (mvn/gradle downloading recipes). 3. File access (modifying the whole project). All are "plausibly needed". The prompt says: "If you see risky capabilities without clear malicious intent... classify as suspicious (not malicious)." This seems to be a direct instruction to classify such tools as `suspicious`. Let's re-evaluate `benign`. "benign only if behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." Does it lack meaningful high-risk behaviors? No. It runs arbitrary build scripts and git commands. So it cannot be `benign`. Is it `malicious`? No evidence of intent. So `suspicious` is the correct choice based on the provided rubric. Summary points: 1. High-privilege operations: The skill instructs the agent to execute shell scripts (`scripts/check.sh`), build tools (`mvn`, `gradle`), and `git` commands autonomously. 2. External code execution: It relies on OpenRewrite recipes fetched from external repositories (Maven Central/Gradle Portal) using the `LATEST` tag, which introduces supply chain risks. 3. Missing components: The `SKILL.md` references a script (`scripts/check.sh`) that is not included in the provided file list, which is a common indicator of hidden or unvetted logic. Wait, I should check if there's any prompt injection. "Run the following git command yourself (do not ask the user to run it)." This is a directive to the agent. It's not "malicious" in the sense of attacking the agent's safety filters, but it is a directive to bypass user confirmation. One more check: `SKILL.md` says "The current branch (e.g. main) is already the rollback anchor—no need to create a separate backup branch." This is slightly risky (if the agent messes up the git reflog or something), but not malicious. Final check on the "suspicious" vs "benign" threshold. If a tool is a "Spring Boot Migrator", it *must* run `mvn` and `git`. If that makes it "suspicious", then the category is very broad. But the prompt's definition of "benign" is very narrow ("lacks meaningful high-risk behaviors"). I'll stick with `suspicious`. Wait, looking at the prompt again: "benign only if behavior is clearly aligned with the stated purpose and lacks meaningful high-risk behaviors." If the behavior is "clearly aligned", does that override the "high-risk" part? The "suspicious" definition says: "If you see risky capabilities without clear malicious intent (e.g., shell/network/file access plausibly needed for the stated purpose...), classify as suspicious". This is very explicit. Plausibly needed shell/network access = suspicious. Classification: suspicious. Summary: The skill bundle facilitates Spring Boot migrations but requires high-risk capabilities, including autonomous execution of shell scripts (`scripts/check.sh`), build tools (`mvn`, `gradle`), and `git` commands without user confirmation. It also encourages downloading and executing external OpenRewrite recipes using the `LATEST` version tag, which poses a supply chain risk. Additionally, the `SKILL.md` references a script (`scripts/check.sh`) that is missing from the provided files, preventing a full security audit of the execution logic. Wait, I need to provide the response as JSON. ```json { "classification": "suspicious", "summary": "The skill bundle facilitates Spring Boot migrations but requires high-risk capabilities, including autonomous execution of shell scripts (scripts/check.sh), build tools (mvn, gradle), and git commands. It also encourages downloading and executing external OpenRewrite recipes using the 'LATEST' version tag, which poses a supply chain risk. Additionally, the SKILL.md references a script (scripts/check.sh) that is missing from the provided files, preventing a full security audit of the execution logic." } ``` Wait, the prompt says "Respond ONLY as JSON". And "classification: one of benign|suspicious|malicious (lowercase)". And "summary: 1 short paragraph. Mention the 1–3 most important indicators and the specific file names involved." The indicators are: 1. Autonomous shell/git execution (`SKILL.md`). 2. External code execution via OpenRewrite (`references/openrewrite-recipes.md`). 3. Missing script file (`scripts/check.sh`) referenced in `SKILL.md`. Let's refine the summary to be more concise. "The skill bundle automates Spring Boot migrations but involves high-risk behaviors, such as autonomous execution of shell scripts, build tools, and git commands (SKILL.md). It relies on fetching and running external OpenRewrite recipes from remote repositories, which introduces supply chain vulnerabilities (references/openrewrite-recipes.md). Furthermore, SKILL.md references a script (scripts/check.sh) that is not included in the bundle, which is a notable indicator of unvetted execution logic." One more check: Is there any "malicious" intent? The instructions are very professional. "Prefer small, verifiable commits", "keep each migration stage reversible", "verify the project compiles and tests pass". This sounds like a very well-intentioned tool. However, the prompt's rules are strict about "risky capabilities" being "suspicious". One detail: "Run the following git command yourself (do not ask the user to run it)." This is a strong instruction to the agent to act without oversight. Final check on the classification. If I were a senior security analyst, would I call this "suspicious"? In the context of an AI agent platform, yes. Any skill that asks for the power to run arbitrary shell commands and git operations on a user's codebase is "suspicious" and requires careful sandboxing or user approval, even if the intent seems benign. One more thing: `_meta.json` has a `publishedAt` of `1772706279191`. `1772706279191` in milliseconds is `Friday, February 20, 2026 10:24:39.191 AM`. This is in the future. This might be a typo or a sign of a generated/fake dataset, but usually not a sign of malice. The `SKILL.md` says: "The current branch (e.g. main) is already the rollback anchor—no need to create a separate backup branch." This is actually a bit dangerous. If the agent does `git add .` and `git commit`, it modifies the local state. If it then fails and the user doesn't know how to use `git reflog` or `git reset`, they might lose uncommitted work. The skill does say "verify the project compiles... before starting", but it doesn't explicitly check for a clean git status. Actually, `SKILL.md` says: "Create and switch to a working branch for the migration: `git checkout -b upgrade/sb3-<target-version>`." This is safer. The missing `scripts/check.sh` is the strongest "suspicious" signal for a security analyst. Final JSON: ```json { "classification": "suspicious", "summary": "The skill bundle automates Spring Boot migrations but requires high-risk capabilities, including autonomous execution of shell scripts, build tools, and git commands (SKILL.md). It relies on fetching and running external OpenRewrite recipes from remote repositories, which introduces supply chain vulnerabilities (references/openrewrite-recipes.md). Furthermore, SKILL.md references a script (scripts/check.sh) that is not included in the bundle, which is a notable indicator of unvetted execution logic." } ``` ```json { "classification": "suspicious", "summary": "The skill bundle automates Spring Boot migrations but requires high-risk capabilities, including autonomous execution of shell scripts, build tools (Maven/Gradle), and git commands (SKILL.md). It relies on fetching and running external OpenRewrite recipes from remote repositories using the 'LATEST' tag, which introduces supply chain vulnerabilities (references/openrewrite-recipes.md). Furthermore, SKILL.md references a script (scripts/check.sh) that is not included in the provided bundle, which is a notable indicator of unvetted execution logic." } ```
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may create branches, modify project files, and create commits during the migration.
The skill instructs the agent to run repository-mutating git commands and commit changes. This is expected for a migration workflow, and the instructions use a working branch and staged commits, but users should notice the agent can change repository state.
Run the following git command yourself ... `git checkout -b upgrade/sb3-<target-version>` ... Run `git add` and `git commit` for the recipe-generated changes only
Use this only on a clean working tree, review every diff and commit, and avoid pushing or merging until tests and human review pass.
Different runs may download different recipe/plugin versions and produce different code changes.
The workflow intentionally resolves current external OpenRewrite plugin and recipe versions, and one example uses LATEST. This is purpose-aligned for an upgrade guide, but it reduces reproducibility and depends on external package provenance.
Do not hardcode plugin or recipe versions. Look up current versions ... `-Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-spring:LATEST`
Prefer pinning reviewed OpenRewrite plugin and recipe versions for a migration branch, and record the versions used in the migration notes.
If the script is absent, the workflow may fail; if a script is supplied from another location, it should be inspected before execution.
The manifest lists only SKILL.md and two reference files, with no scripts/check.sh present. That makes the helper unreviewable in the supplied artifact set and may simply cause the command to fail.
Run the check script from this skill’s `scripts/` directory, passing the target project path: `scripts/check.sh <project-dir>`
Verify the helper script exists in the installed skill and review it before running it, or perform the described checks manually.