The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references a JAR artifact from the vendor's Nexus repository (nexus.adaptavist.net). The artifact is bundled within the skill assets (assets/hapi-0.2.104.jar) and verified by a SHA-256 hash provided in both the metadata and the machine-readable provenance file. This represents standard artifact distribution for a developer tool.
[COMMAND_EXECUTION]: The skill uses sms-hapi-lookup and sms-groovy-check commands. As described, these tools perform static inspection of bytecode signatures using javap rather than executing the classes. This is a safe inspection pattern for developer tooling.
[INDIRECT_PROMPT_INJECTION]: The skill processes class names and API signatures. While these could theoretically contain injection attempts, the skill explicitly instructs the agent to treat the bundled JAR as the authority and provides safety warnings against passing untrusted text as a class name. The capability tier is restricted to inspection, which mitigates risk.

scriptrunner-hapi-api