The Agent Skills Directory

Command Execution: The skill utilizes several standard command-line tools, including gpg, git, find, and mvn, to perform integrity and compliance checks. These operations are restricted to the local environment and are necessary for release verification.
External Downloads: The skill fetches public GPG keys and release artifacts from URLs defined in project configuration files. These downloads are required to verify the authenticity of the release and target infrastructure associated with the project's organization.
Dynamic Execution of Local Scripts: The skill is designed to run validation commands specified in the project's release-build.md (e.g., source_tree_validators). While this allows for project-specific flexibility, it involves executing arbitrary locally-defined commands during the audit process.
Indirect Prompt Injection Surface: As the skill processes externally supplied data—such as artifacts, signature files, and manifest contents—it maintains an attack surface for indirect prompt injection. The skill includes specific instructions to treat all external content as data and not as instructions, providing a layer of protection against such attempts.

verify-rc