The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill correctly demonstrates secure practices by using environment variables and secret management tools like HashiCorp Vault (e.g., quarkus.oidc.credentials.secret=${OIDC_SECRET}). It avoids hardcoding sensitive information, using example domains like example.com for configuration templates.
[COMMAND_EXECUTION]: The skill mentions standard development and security auditing commands using Maven and Gradle (e.g., mvn org.owasp:dependency-check-maven:check). These are best-practice tools for vulnerability scanning and do not constitute arbitrary or dangerous command execution.
[SQL_INJECTION]: The skill provides explicit guidance on preventing SQL injection by recommending Panache parameterized queries and safe native query patterns, while identifying string concatenation in queries as a 'BAD' practice.
[PROMPT_INJECTION]: The instructions are focused on providing development guidance and do not contain any attempts to override agent behavior, bypass safety filters, or extract system prompts.
[INDIRECT_PROMPT_INJECTION]: While the skill guides the agent on how to handle user-provided data, it emphasizes strict input validation using Bean Validation (e.g., @NotBlank, @Email, @Pattern) and custom validators to sanitize external inputs.

quarkus-security