egovframe-compatibility — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited egovframe-compatibility (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
eGovFrame 4.x/5.x adds constraints on top of Spring conventions for government system development. Only eGovFrame-specific rules are documented here — Spring Framework knowledge assumed.
Scope: Java projects using org.egovframe.rte.* (eGovFrame 4.x+). Excludes egovframework.rte.* (3.10 and earlier), non-Java code, and frontend concerns.
Target: @Controller, @RestController, and Servlet code only when Spring MVC is impractical and justified.
Rules:
SqlMapClientDaoSupport, SqlSessionDaoSupport, and HibernateDaoSupport.// ✅ Correct
@Controller
@RequestMapping("/sample")
public class SampleController {
@Autowired
private SampleService sampleService;
@GetMapping("/list")
public String list(Model model) {
model.addAttribute("list", sampleService.selectList());
return "sample/list";
}
}
// ❌ DAO injected directly — forbidden
@Controller
public class SampleController {
@Autowired
private SampleMapper sampleMapper; // ❌ inject Service, not DAO
}
// ❌ Business logic handled inside controller — forbidden
@GetMapping("/calc")
public String calc(Model model) {
int result = heavyBusinessCalculation(); // ❌ delegate to Service
model.addAttribute("result", result);
return "sample/result";
}Target: @Service or @Component business classes, excluding tests.
Rules:
EgovAbstractServiceImpl, directly or through a base class.Why the interface matters: eGovFrame AOP relies on Java Dynamic Proxy, not CGLIB — class-only services cannot be proxied.
// ✅ Correct — interface + implementation pair
public interface SampleService {
List<SampleVO> selectList(SampleVO vo) throws Exception;
}
@Service("sampleService")
public class SampleServiceImpl extends EgovAbstractServiceImpl implements SampleService {
@Autowired
private SampleMapper sampleMapper;
@Override
public List<SampleVO> selectList(SampleVO vo) throws Exception {
return sampleMapper.selectList(vo);
}
}
// ❌ No interface — Java Proxy cannot proxy a class-only service
@Service
public class SampleService extends EgovAbstractServiceImpl { }
// ❌ Missing EgovAbstractServiceImpl
@Service
public class SampleServiceImpl implements SampleService { }Target: @Repository classes and mapper/repository code.
| Technology | Required pattern |
|---|---|
| iBatis | extends EgovAbstractDAO |
| MyBatis class mapper | extends EgovAbstractMapper |
| MyBatis interface mapper | @Mapper plus eGovFrame MapperConfigurer |
| JPA | extends JpaRepository, CrudRepository, or PagingAndSortingRepository |
| JPA alternative | Inject HibernateTemplate or EntityManager directly or via a base class |
Forbidden: Direct calls to insert, delete, update, select, or list on SqlMapClientDaoSupport or SqlSessionDaoSupport.
// ✅ MyBatis class mapper
@Repository
public class SampleMapper extends EgovAbstractMapper {
public List<SampleVO> selectList(SampleVO vo) {
return selectList("sample.selectList", vo);
}
}
// ✅ MyBatis interface mapper
@Mapper
public interface SampleMapper {
List<SampleVO> selectList(SampleVO vo);
}
// ✅ JPA
public interface SampleRepository extends JpaRepository<Sample, Long> {
List<Sample> findByStatus(String status);
}
// ❌ Direct SqlSessionDaoSupport call — forbidden
@Repository
public class SampleDAO extends SqlSessionDaoSupport {
public List<SampleVO> selectList(SampleVO vo) {
return getSqlSession().selectList("sample.selectList", vo); // ❌
}
}Target: XML config plus equivalent Java Config or Spring Boot config.
Required inclusions:
<tx:advice> plus <aop:config>) or @Transactional<!-- ✅ AOP transaction + DBCP -->
<tx:advice id="txAdvice" transaction-manager="transactionManager">
<tx:attributes>
<tx:method name="*" rollback-for="Exception"/>
</tx:attributes>
</tx:advice>
<aop:config>
<aop:pointcut id="txPointcut" expression="execution(* *..*ServiceImpl.*(..))"/>
<aop:advisor advice-ref="txAdvice" pointcut-ref="txPointcut"/>
</aop:config>
<bean id="dataSource" class="org.apache.commons.dbcp2.BasicDataSource" destroy-method="close"/>// ✅ Java Config
@Configuration
@EnableTransactionManagement
public class AppConfig {
@Bean
public DataSource dataSource() {
return new HikariDataSource();
}
}<!-- ❌ No transaction configuration — eGovFrame feature not applied -->
<!-- ❌ Using JDBC DriverManager directly — no connection pool -->Required libraries: use the same version for all of these:
org.egovframe.rte.ptl.mvc-[version].jar
org.egovframe.rte.fdl.cmmn-[version].jar
org.egovframe.rte.psl.dataaccess-[version].jar
org.egovframe.rte.fdl.logging-[version].jarLibrary rules:
org.egovframe.rte.* JARs — MD5/SHA1 must match original distribution.Extension rules: if extending an eGovFrame RTE class:
// ❌ Forbidden package
package org.egovframe.rte.custom; // ❌ must not define classes inside rte packages
public class MyDAO extends EgovAbstractDAO { }
// ❌ Forbidden naming
public class EgovCustomDAO extends EgovAbstractDAO { } // ❌ must not start with "Egov"
// ✅ Correct extension
package com.example.common.dao;
public class CommonDAO extends EgovAbstractDAO { }Controller → Service → DAO; do not skip layers.Package layout — choose one and apply consistently across the entire project:
// ✅ Domain-first (applied consistently)
com.example.sample.controller.SampleController
com.example.sample.service.SampleService
com.example.sample.dao.SampleMapper
// ✅ Layer-first (applied consistently)
com.example.controller.sample.SampleController
com.example.service.sample.SampleService
com.example.dao.sample.SampleMapper
// ❌ Mixed layout — forbidden
com.example.sample.controller.SampleController // domain-first
com.example.service.other.OtherService // layer-first (mixed)Naming convention — choose one and apply consistently:
// ✅ Business-code style (applied consistently)
AA0011Controller, AA0011ServiceImpl, AA0011Mapper
// ✅ Word style (applied consistently)
MemberController, MemberServiceImpl, MemberMapper
// ❌ Mixed styles — forbidden
AA0011Controller // business-code style
MemberServiceImpl // word style (mixed)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.