The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions in SKILL.md recommend the dependency dev.langchain4j:langchain4j-spring-boot-starter:1.8.0. As the library currently uses a 0.x.y versioning scheme (e.g., 0.35.0), version 1.8.0 is non-existent. Recommending non-existent versions of external libraries can facilitate dependency confusion attacks or lead to the execution of malicious code if an attacker registers the version in a public or private registry.
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external, untrusted data through AI services without sufficient isolation or validation logic.
Ingestion points: Multiple entry points exist in SKILL.md (handleInquiry, translate) and references/examples.md (analyzeSentiment, extractEntities, answerAbout).
Boundary markers: While @SystemMessage is used to define the agent's persona, the skill does not use specific delimiters or instructions to treat user input strictly as data, leaving it vulnerable to instruction override.
Capability inventory: The skill enables high-privilege tools including Bash, Write, and Edit. It also provides implementation patterns for custom tools like Calculator and WeatherService which are accessible to the agent.
Sanitization: No input sanitization or filtering logic is provided in the integration examples to handle adversarial payloads.
[DATA_EXFILTRATION]: In references/configuration.md, the skill suggests enabling log-requests and log-responses for various AI providers. Logging full request and response bodies is a risk for sensitive data exposure as it may capture personally identifiable information (PII) or secrets within system logs.
[CREDENTIALS_SAFE]: The skill correctly demonstrates secure credential management by recommending the use of environment variable placeholders (e.g., ${OPENAI_API_KEY}) and System.getenv() calls in configuration examples.
[COMMAND_EXECUTION]: The integration of the Bash tool in the skill's allowed configuration, paired with declarative AI services that process user input, creates a risk where prompt injection could lead to the agent executing unauthorized system commands.

langchain4j-spring-boot-integration