The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes standard build and security tools including Maven (mvn), Gradle (./gradlew), Docker, K6, Trivy, and Grype. These commands are used as intended for building projects, running tests, and performing security audits.
[EXTERNAL_DOWNLOADS]: The skill performs network requests using curl to fetch OpenAPI definitions and health check status from localhost. It also references official Docker images from the OWASP ZAP project and standard GitHub Actions from verified organizations (GitHub Actions and Codecov). These operations are standard for a development environment and pose no security risk.
[CREDENTIALS_UNSAFE]: The skill correctly demonstrates best practices for secret management by utilizing environment variables (${SONAR_TOKEN}) and CI/CD secrets (${{ secrets.CODECOV_TOKEN }}) rather than hardcoding credentials.

quarkus-verification