The Agent Skills Directory

[SAFE]: The skill provides standard development instructions for plain Java projects, focusing on Maven and Gradle usage, project structure, and modern language idioms.
[DATA_EXPOSURE]: The skill promotes safe secret management by explicitly advising against hardcoding API keys (such as the NVD API key) in source code or command lines, recommending the use of environment variables and CI secrets instead.
[EXTERNAL_DOWNLOADS]: The skill references standard plugins and libraries (e.g., SLF4J, JUnit, Error Prone, Spotless) from well-known technology organizations and official registries like Maven Central and the Gradle Plugin Portal.
[INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data which could be attacker-controlled and possesses the capability to execute shell commands for building and testing.
Ingestion points: The agent reads pom.xml, build.gradle, source code files, and CI configurations to determine project context.
Boundary markers: The instructions include strict rules requiring the agent to "Ask the user" before modifying public APIs, changing dependencies, or altering CI workflows.
Capability inventory: The skill uses standard build tools (mvn, gradle) and packaging utilities (jlink, jpackage) via shell execution.
Sanitization: The skill provides explicit guidance on avoiding injection vulnerabilities (SQL/JSON) and maintaining minimal CI permissions.

java-development