The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill executes arbitrary code from the analyzed repository during the build and test phases.
The mvn compile command triggers annotation processors and build plugins defined in the project's pom.xml.
The mvn test command executes arbitrary test code contained within the repository.
The skill mitigates this risk by requiring explicit user confirmation before execution and recommending an isolated environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and parses untrusted data from the repository which could contain malicious instructions.
Ingestion points include source code comments, Git log messages, and XML reports generated by static analysis tools.
The skill includes a specific safeguard (Rule 4) instructing the agent to treat all parsed content as data and never as directives.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation and execution of Java-based analysis tools.
It compiles the project's source code to generate bytecode for analysis by tools like SpotBugs and ArchUnit.
It executes a local script (ArchUnitAnalysis.java) using JBang which dynamically loads the ArchUnit library to perform architectural metrics calculations.
[COMMAND_EXECUTION]: The skill utilizes several shell-based tools for Git forensics and file system operations.
Commands include git log, find, xargs, and wc to analyze churn, ownership, and complexity.
These commands are used with fixed patterns to analyze local repository files.

java-repo-assessment