The Agent Skills Directory

[COMMAND_EXECUTION]: The skill automates complex release workflows by executing local shell scripts (release-sdk.sh, release-starter.sh, cve-scan.sh) which in turn invoke git, mvn, perl, and python3 to perform repository management and artifact publishing.
[EXTERNAL_DOWNLOADS]: The cve-scan.sh script makes network requests to api.osv.dev to retrieve vulnerability data for project dependencies. This targets a well-known and trusted security service provided by Google.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from local pom.xml files to determine project versions and dependency coordinates.
Ingestion points: Project pom.xml files are read by scripts using grep, sed, perl, and Maven plugins.
Boundary markers: None; the scripts assume the project files are trusted artifacts within the developer's local environment.
Capability inventory: The skill has capabilities to modify the local file system (via Maven and Perl), perform git operations (commit, tag, push), and execute network operations (publishing artifacts to Maven Central and Aliyun).
Sanitization: The scripts use regex-based extraction to parse dependency information from XML tags before including them in vulnerability queries.

easy4j-deploy