springboot-unit-testing

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:50 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent testing guidance, but its install instructions use unresolved unauthenticated GitHub placeholders and some examples could destabilize test environments if copied directly.

Review the package before installing from anything other than ClawHub. Do not use the documented placeholder GitHub or wget install paths unless the publisher replaces them with a verified repository, pinned release, and checksum/signature verification. If installed, run the scripts only on a disposable or version-controlled test project, review generated files before committing, keep skip-authentication settings confined to test profiles, and avoid copying the deliberate memory-exhaustion examples into normal CI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: README.md:28

Finding

Unverified Remote Skill Package Installation

Content

View full analysis

Remediation

View remediation

springboot-unit-testing-skill-v1.0.0.zip" | sha256sum --check - ``` 4. Prefer signed release artifacts and document signature verification using a publisher-controlled signing key. 5. Ensure the ClawHub publisher identity, package metadata, README, and repository ownership consistently identify the same trusted organization. 6. Add CI release controls that build archives from reviewed tags, generate provenance attestations, and prevent modification of published releases. 7. Do not instruct users to load or execute package contents until authenticity and integrity verification succeeds. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/boundary-testing.md:851

Finding

Boundary-Test Examples Intentionally Exhaust JVM Memory

Content

View full analysis

service.processLargeData(data)); } // Test insufficient memory if (!isMemoryLimitedEnvironment()) { int hugeSize = Integer.MAX_VALUE - 8; assertThrows(OutOfMemoryError.class, () -> new byte[hugeSize]); } } ``` The same reference also recommends another unusually large allocation: ```java // Test an extremely large string if (!isMemoryLimitedEnvironment()) { int hugeLength = 100_000_000; assertThrows(OutOfMemoryError.class, () -> "a".repeat(hugeLength)); } ``` The environment check is: ```java private boolean isMemoryLimitedEnvironment() { long maxMemory = Runtime.getRuntime().maxMemory(); return maxMemory < 1024 * 1024 * 1024; } ``` ### Technical Analysis The example allocates arrays as large as one gigabyte and deliberately attempts an allocation near Java's maximum array size. It also attempts to construct a string containing 100 million characters. Using `assertThrows(OutOfMemoryError.class, ...)` does not make heap exhaustion safe. An allocation failure can cause severe garbage-collection pressure, destabilize unrelated tests, terminate the JVM, or trigger host/container out-of-memory handling before JUnit can reliably process the error. The guard is also inadequate. It runs the dangerous tests whenever the JVM reports a maximum heap of at least one gigabyte, even though the JVM may not have enough current ...[truncated 1469 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a unit-test authoring and strategy assistant, yet the detected behavior focuses on analyzing test sources, parsing Surefire/JaCoCo reports, and producing JSON/HTML reports. This discrepancy matters because report generation and build analysis require broader access than users would expect from a simple authoring skill, increasing the chance of overbroad data exposure and unintended automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a unit-test authoring and strategy assistant, yet the detected behavior focuses on analyzing test sources, parsing Surefire/JaCoCo reports, and producing JSON/HTML reports. This discrepancy matters because report generation and build analysis require broader access than users would expect from a simple authoring skill, increasing the chance of overbroad data exposure and unintended automation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a unit-test authoring and strategy assistant, yet the detected behavior focuses on analyzing test sources, parsing Surefire/JaCoCo reports, and producing JSON/HTML reports. This discrepancy matters because report generation and build analysis require broader access than users would expect from a simple authoring skill, increasing the chance of overbroad data exposure and unintended automation.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/dependencies.md (reported line 7)May include surrounding context.

核心测试依赖

xml

<!-- Spring Boot Test Starter -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill title and the entire README are presented only in Chinese, with no indication that other languages are supported or that the user can choose their preferred language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documentation indicates behaviors consistent with file reads, file writes, and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where consumers may invoke a skill without understanding its operational reach, increasing the risk of unintended command execution or filesystem modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad and lack clear exclusions, making it more likely the skill will be invoked in contexts beyond its intended scope. When a skill may also read/write files or invoke shell-related workflows, overly broad activation increases the chance of accidental execution on sensitive projects or inappropriate tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description and usage text are written entirely in Chinese, but the file does not state that the skill is China-specific or that users can choose another language. This can violate language/locale policy expectations when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This manifest/config file contains human-readable comments and labels exclusively in Chinese, which imposes a specific language on users and maintainers. Under the language/locale policy, this is a natural-language policy violation unless the file offers language choice or clearly documents that it is intended only for a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The configuration explicitly enables skip-authentication: true, which is an unsafe default even in a test profile because such settings are often copied into other environments or accidentally activated during deployment. If this flag is honored by application code outside tightly isolated tests, it can disable access control entirely and permit unauthorized access to protected functionality.

Content

Scanner excerpt · examples/application-test-example.yml (reported line 267)May include surrounding context.

yaml

# 启用测试专用特性
  test-features:
    mock-external-services: true
    skip-authentication: true
    generate-test-data: true

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest presents this skill primarily as a Spring Boot/MyBatis unit-testing skill, while this configuration includes a concrete integration-test datasource pointing to jdbc:mysql://localhost:3306 with credentials. Although integration testing is mentioned, binding the example to a real external database goes beyond the expected unit-test-focused scope and changes the operational behavior from isolated test guidance to live database connectivity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The section labeled application-integration.yml (集成测试) includes both a direct localhost MySQL datasource and a separate testcontainers.mysql block. This is contradictory in intent: the documentation suggests containerized integration testing, but the active datasource shown actually targets an external locally running MySQL instance instead of a container-provisioned database.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document title and all instructional content are written exclusively in Chinese, with no indication that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This creates a natural-language locale constraint that may violate organizational language-choice policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

技能清单强调的是 Spring Boot + MyBatis + MySQL 项目的单元测试、Mapper/Service/Controller/集成测试能力，但该文档专门加入了 externalService、HTTP 请求、服务健康检查、上传与网络中断等外部依赖异常测试模式。这些内容并非 MyBatis/MySQL 单元测试目的下的直接核心实现细节，导致技能描述与实际提供的能力范围不完全一致。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

manifest 将技能定位为 Spring Boot + MyBatis + MySQL 项目的专业单元测试技能，而这里提供了 OutOfMemoryError、StackOverflowError、ClassNotFoundException 等系统级/运行时环境故障测试模式。这类 JVM/类加载层面的异常不属于该技能声明中的显式重点，也不是实现 Mapper、Service、Controller 或数据库测试所必需的直接内容。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The transaction rollback example is semantically misleading because assertions about entity nonexistence inside a @Transactional test can misrepresent actual rollback behavior and persistence context state. In practice, developers may build incorrect tests for transactional guarantees, causing false assurance around data consistency and exception-handling behavior in production.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown skill content forces a specific language for all users, and the file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This is a code file, so natural-language policy checks apply to docstrings, comments, and printed messages. The file presents its purpose and usage in Chinese only, and there is no indication that the skill is intentionally region-specific or that users can opt into another language, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains natural-language descriptions and all user-facing messages in Chinese, beginning with the module docstring and continuing throughout the script. The file does not provide any opt-in, configuration, or documented justification for enforcing a specific language, which conflicts with the policy against unprompted language/locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file's natural-language content, including the class-level documentation and inline comments, is entirely in Chinese. Under the stated policy, language-specific behavior or presentation should not be forced without opt-in or a clearly justified regional scope, and no such justification appears in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This SQL test-data file includes natural-language comments entirely in Chinese, such as the section headers and inline explanations. The policy requires flagging language or locale constraints when a specific language is imposed without user opt-in, and no alternative language choice or justification is provided in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The package description is written entirely in Chinese, which can impose a language preference on users without any stated opt-in, alternative locale, or justification that the skill is China-specific. This matches the policy category for language or locale constraints expressed in natural-language metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file title and the entire instructional content are presented in Chinese, which effectively fixes the skill's language/locale without any opt-in or alternative language guidance. The policy for this audit flags language constraints when the skill forces a specific language without user choice or a clearly documented regional justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

At L0458-L0460 the documentation frames this as a hash-collision boundary test and claims there are 'only 100 different hash values'. However, the code merely reuses 100 different string keys via modulo arithmetic; it does not construct keys with colliding hash codes. This is an active contradiction between the explanatory comment and the actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This markdown file presents all instructions and descriptions in Chinese only, with no indication that the skill is region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.