The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local shell scripts to automate project release cycles, involving Git and Maven operations.
Evidence: The scripts scripts/release-sdk.sh and scripts/release-starter.sh manage the end-to-end release process, including version bumping, tagging, and deployment to Maven Central.
[EXTERNAL_DOWNLOADS]: The skill interacts with established software registries and security services for dependency validation and metadata retrieval.
Evidence: scripts/cve-scan.sh performs automated vulnerability lookups by querying https://api.osv.dev/v1/querybatch.
Evidence: The dependency management guidelines in references/dependency-matrix.md utilize curl to verify artifact availability on repo1.maven.org and maven.aliyun.com.
[REMOTE_CODE_EXECUTION]: A localized Python execution is used for processing JSON data within the scanning script.
Evidence: scripts/cve-scan.sh pipes the output of a network request into python3 -c using a static, hardcoded parsing script. This does not involve executing arbitrary code from a remote source.
[INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files (pom.xml) which could theoretically contain malicious data, though the risk is mitigated by specific parsing logic.
Ingestion points: Automated parsing of version strings and property tags from the local pom.xml file.
Capability inventory: The agent has the authority to execute shell commands, perform builds, and push changes to remote Git branches.
Boundary markers: The scripts use specific XML tag matching (via grep and perl) to isolate version data from other file content.
Sanitization: Extracted version strings are used as arguments to Maven and Git commands, with the logic restricted to expected semantic versioning patterns.

easy4j-deploy