springboot-unit-testing

ReviewAudited by ClawScan on May 1, 2026.

Overview

This appears to be a legitimate Spring Boot testing helper, but its optional scripts run local build commands and generate test files/SQL that should only be used in a test project.

Before installing or running this skill, verify the source, review the included scripts, and run them only inside a non-production Spring Boot project. Pay particular attention to generated SQL cleanup statements and ensure tests use an isolated test database.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

If the user invokes these scripts, they will run local build/test tooling and Python code in the project environment.

Why it was flagged

The package exposes local shell/Python commands. They are purpose-aligned for coverage checking and report/data generation, but running them executes code on the user's machine.

Skill content

"check-coverage": "./scripts/check-coverage.sh", "generate-data": "python scripts/generate-test-data.py .", "generate-report": "python scripts/generate-test-report.py ."

Recommendation

Run the scripts only in a trusted project checkout and review changes they make before committing or using generated files.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

Using the generated SQL with the wrong database connection could delete rows from application tables.

Why it was flagged

The generated SQL test data includes table-clearing statements. This is normal for isolated test databases, but it would be risky if run against a real or shared database.

Skill content

DELETE FROM user;
DELETE FROM order;
DELETE FROM product;
DELETE FROM category;

Recommendation

Use the generated SQL only with H2, Testcontainers, or another isolated non-production test database, and inspect the SQL before execution.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user following placeholder or substituted repository links could install from an unverified source.

Why it was flagged

The install documentation uses a placeholder repository URL, which does not establish a verifiable upstream source.

Skill content

git clone https://github.com/your-repo/springboot-unit-testing.git

Recommendation

Install from the reviewed ClawHub package or a clearly verified repository, and avoid copying install commands that still contain placeholder URLs.